Senior Information Security Manager (GRC)

Meet DeepL

DeepL is a global AI product and research company focused on building secure, intelligent solutions to complex business problems. Over 200,000 business customers and millions of individuals across 228 global markets today trust DeepL's Language AI platform for human-like translation, improved writing and real-time voice translation.
Founded in 2017 by CEO Jaroslaw "Jarek" Kutylowski, DeepL now has around 1,000 passionate employees and is supported by world-renowned investors including Benchmark, IVP, and Index Ventures.

Our goal is to become the global leader in trusted, intelligent AI technology, building products that drive better communication, foster connections, and create a meaningful impact. To achieve this, we need talented people like you to join our journey. If you're ready to shape the future of AI and grow your career in a fast-moving, purpose-driven environment, DeepL is your next destination.

What sets us apart is our blend of cutting-edge AI technology, meaningful work, and a culture where people truly thrive. We're a team of innovators, researchers, and creators driven by a shared purpose to unlock human potential by making work simpler, smarter, and more connected.

When we share what it's like to work at DeepL, the reactions are overwhelmingly positive. This might be because of our technology that helps millions of people and businesses communicate and work better every day, or because of the trust, curiosity, and care that shape our culture.

What we know for sure is this: being part of DeepL means joining a team dedicated to innovation, growth, and well-being. Discover more about life at DeepL on Linked In, Instagram, and our Blog.

DeepL is looking for a Senior Information Security Manager to strengthen our Governance, Risk, and Compliance (GRC) function. You'll own the day-to-day operation of our information security and compliance program, with a strong focus on ISO 27001 and SOC 2 Type II, and a bonus if you bring HIPAA or BSI C5 experience to the table.

This isn't a "gatekeeper" role. We're a SaaS scale-up, and our product teams move fast. We need someone who understands risk well enough to take calculated ones, someone who can say "yes, and here's how we do it safely" instead of defaulting to "no." You'll be the person who keeps compliance moving at the speed of the business, not the person who slows it down.

You'll be part of our Information Security team, sitting within the broader Security track alongside the IT Security team, both under our Head of Security. You'll work closely with your teammates in Information Security and IT Security to make sure security and compliance work hand in hand rather than in separate lanes.

Program ownership

• Own and continuously improve our Information Security Management System (ISMS), keeping it aligned with ISO 27001, SOC 2 Type II, and, where relevant, HIPAA and BSI C5

• Maintain and mature our risk register, policy library, vendor/third-party risk assessments, and control monitoring

Audits & evidence

• Act as a hands-on participant in audits, working directly with auditors, control owners, and leadership to prepare, execute, and close out certification and attestation cycles efficiently rather than through brute force

• Build and refine evidence collection processes using automation and GRC tooling (e.g. Vanta or similar), reducing manual overhead and audit fatigue across the company

• Design and roll out a model where product and engineering teams own their evidence throughout the control lifecycle, rather than compliance chasing people down before every audit

Risk & business partnership

• Assess risk pragmatically: identify real security and compliance exposure, size it accurately, and make calculated calls that unblock product and engineering teams

• Partner with engineering, product, IT, People, and Legal to embed security and compliance requirements into existing workflows rather than bolting them on afterward

• Track regulatory and customer-driven compliance requirements - new customer security questionnaires, evolving frameworks - and translate them into practical, actionable controls

Reporting

• Report on the state of the security and compliance program to stakeholders and leadership, including audit readiness, open risks, and remediation progress

• 3-5 years of experience in information security, GRC, or compliance roles, ideally at a SaaS company, and ideally at scaleup pace and scale

• Hands-on experience running or supporting ISO 27001 and SOC 2 Type II programs and audits, from control design through evidence collection to certification

• Experience with HIPAA and/or BSI C5 is a strong plus

• Practical experience with GRC/evidence automation tooling such as Vanta (or equivalent), including building smooth, low-friction processes around it

• A track record of building processes that shift evidence ownership to the teams generating the evidence, rather than centralizing it all in…