> Markdown version of [/jobs/ext/2472029-senior-information-security-manager-grc](https://www.wearedevelopers.com/jobs/ext/2472029-senior-information-security-manager-grc). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Information Security Manager (GRC)

- **Company:** DeepL GmbH
- **Location:** Köln, Germany (Remote available)
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Software as a Service, Cyber Security, Information Security Management System
- **Published:** August 5, 2026
- **Apply:** https://de.indeed.com/viewjob?jk=8d5af39a864a3baf

## About the Role

* 3-5 years of experience in information security, GRC, or compliance roles, ideally at a SaaS company, and ideally at scaleup pace and scale
 * Hands-on experience running or supporting ISO 27001 and SOC 2 Type II programs and audits, from control design through evidence collection to certification
 * Experience with HIPAA and/or BSI C5 is a strong plus
 * Practical experience with GRC/evidence automation tooling such as Vanta (or equivalent), including building smooth, low-friction processes around it
 * A track record of building processes that shift evidence ownership to the teams generating the evidence, rather than centralizing it all in compliance
 * Sound risk judgment: comfortable making calculated, defensible risk decisions to keep product teams unblocked, rather than reflexively blocking
 * Strong stakeholder management skills; able to work credibly with engineers, product managers, and leadership without becoming an obstacle
 * Fluent English and German language skills at C1 level (or close by) are required
 * Clear, structured communicator who can translate compliance requirements into language engineering and product teams actually act on

## Description

DeepL is looking for a Senior Information Security Manager to strengthen our Governance, Risk, and Compliance (GRC) function. You'll own the day-to-day operation of our information security and compliance program, with a strong focus on ISO 27001 and SOC 2 Type II, and a bonus if you bring HIPAA or BSI C5 experience to the table.

This isn't a "gatekeeper" role. We're a SaaS scale-up, and our product teams move fast. We need someone who understands risk well enough to take calculated ones, someone who can say "yes, and here's how we do it safely" instead of defaulting to "no." You'll be the person who keeps compliance moving at the speed of the business, not the person who slows it down.

You'll be part of our Information Security team, sitting within the broader Security track alongside the IT Security team, both under our Head of Security. You'll work closely with your teammates in Information Security and IT Security to make sure security and compliance work hand in hand rather than in separate lanes., Program ownership

 * Own and continuously improve our Information Security Management System (ISMS), keeping it aligned with ISO 27001, SOC 2 Type II, and, where relevant, HIPAA and BSI C5
 * Maintain and mature our risk register, policy library, vendor/third-party risk assessments, and control monitoring

Audits & evidence

 * Act as a hands-on participant in audits, working directly with auditors, control owners, and leadership to prepare, execute, and close out certification and attestation cycles efficiently rather than through brute force
 * Build and refine evidence collection processes using automation and GRC tooling (e.g. Vanta or similar), reducing manual overhead and audit fatigue across the company
 * Design and roll out a model where product and engineering teams own their evidence throughout the control lifecycle, rather than compliance chasing people down before every audit

Risk & business partnership

 * Assess risk pragmatically: identify real security and compliance exposure, size it accurately, and make calculated calls that unblock product and engineering teams
 * Partner with engineering, product, IT, People, and Legal to embed security and compliance requirements into existing workflows rather than bolting them on afterward
 * Track regulatory and customer-driven compliance requirements - new customer security questionnaires, evolving frameworks - and translate them into practical, actionable controls

Reporting

 * Report on the state of the security and compliance program to stakeholders and leadership, including audit readiness, open risks, and remediation progress