Cloud Security

• Own security & compliance end-to-end (cloud, product, internal IT)
• Harden AWS/GCP environments: IAM, networking, encryption, logging, monitoring, detection
• Embed DevSecOps into SDLC: threat modeling & vulnerability management with engineers
• Maintain & improve ISO 27001 and C5 certifications; lead audits and corrective actions
• Manage external security work: penetration tests, security reviews, vendor assessments
• Design & enforce internal IT baseline: identity, MDM, device policies, access model, on/off-boarding
• Provide security training and guidance across the organization

Must-Haves:

• Hands-on cloud security (AWS or GCP) incl. Terraform IaC
• End-to-end ownership of ISO27001 or C5 certification & audits
• DevSecOps, secure SDLC, threat modeling, vulnerability management experience
• German & English - full professional fluency

• 5+ years in similar security/compliance roles Nice-to-Haves:

• Healthcare / highly sensitive data environments
• Medical Device Regulation exposure (MDR, IEC 62304)

• AI/LLM security design experience Dealbreakers / Red Flags:

• Policy-only background with no hands-on technical work
• Lacking audit ownership experience (ISO/C5/SOC2)

• Cannot work on-site in Berlin when required Personality Traits:

• Reliable * Autonomous * Conscientious, * Experience: Minimum 5 years in IT security & compliance with audit ownership
• Education: Bachelor’s degree required (field not specified)
• Specific Tools/Technologies: AWS, GCP, Terraform, logging/monitoring stacks, Vanta (for compliance evidence)