Information Security Officer

The Information Security Officer (ISO) is responsible for managing defined Information Security Management System (ISMS) topics within the responsible area (country, business department, scope, etc.).

Role & responsibilities

• Active part in the Festo Global ISMS
• Point of contact and consulting ISMS requirements and corresponding risks
• Responsible for day-to-day and recurring ISMS tasks (operation, conception, continuous improvement, reporting and monitoring).
• creation and continuous improvement of corporate information security policies by expanding content with country specific/ governmental requirements (IT-GRC) and performing information security risk management, inclusive follow up measures
• Responsible for preparing and performing information security awareness measures aligned with corporate awareness program
• Responsible for reporting ISMS risks, the status of information security measures and its effectiveness to the ISMS Operations Team and the responsible managers
• Responsible for alerting the ISMS Operations Team and the management board in case of major information security incidents or attacks and supporting the incident handling in collaboration with Cyber Security Team (Security Operations Center)
• The job requires a good understanding of the responsible area, keeping up-to-date regarding IT technologies and IT Systems and performing or organizing ISMS audits (internal and external) and risk workshops
• Responsible for the support and coordination of IS audit requests and activities, inclusive follow up / management of Audit findings and reporting to Corporate Information Security Team
• Responsible for the communication with local authorities and other organizations
• Responsible for aligning Information security goals with local organizational goals
• Supporting the Corporate Information Security Team
• Willing to learn and work with standards & legal texts and technical cybersecurity questions
• Ability to establish an external network with respect to cybersecurity (e.g. industry associations, test houses)
• Strong analytical, communication and consulting skills

Preferred candidate profile

• Successfully completed study in informatic, business management or a comparable study
• Extensive professional experience (usually ≥ 5 years)
• It is preferable if former worked in a bigger audit company as IT auditor / IT consultant
• Good IT process knowledge (e.g. ITIL) and general IT technical knowledge
• Desired or preferred certification are ISO27001 certifications (e.g. ISO 27001 Implementer, ISO 27001 Lead Auditor”, or equivalent), CISM, CISSP, CISA, Project Management certifications (e.g. IPMA or equivalent) and Information Security Officer certifications or completed trainings.
• Experience in identifying and managing information security risks, incl. risk lifecycle
• Knowledge in Governance and Compliance to follow up local requirements
• Knowledge in Internal Control Systems (ICS)
• Knowledge/Experience and sufficient usage of Information Security Standards (e.g. ISO 27000 series, NIST, BSI) and Risk Management Standards (ISO31000)
• Good command of native speaking language and of written and spoken English
• Willing to travel