> Markdown version of [/jobs/ext/2989871-information-security-compliance-manager-all-genders](https://www.wearedevelopers.com/jobs/ext/2989871-information-security-compliance-manager-all-genders). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Information Security & Compliance Manager (all genders) - **Company:** fiskaly gmbh - **Location:** Wien, Austria - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Microsoft Azure, Software as a Service, Cloud Engineering, Cyber Security, Continuous Integration, Digital Signature, Systems Development Life Cycle, Software Vulnerability Management, Information Security Management System, RSA Archer Platform - **Published:** September 19, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=32f37ba5c77c3dca ## About the Role * 5+ years in Information Security, Compliance or Risk Management, with a track record of building or maturing an ISMS * You have owned at least one ISO 27001 certification, surveillance or re-certification audit end-to-end - from gap assessment and closing nonconformities to sitting across from the auditor * Deep knowledge of ISO 27001 (2022) and its controls; working knowledge of ISO 9001 and GDPR; able to navigate NIS2 without hand-holding * Genuine fluency in SaaS and cloud environments: you understand GCP and/or Azure, CI/CD, infrastructure-as-code and modern change management well enough to audit them and to talk to engineers as a peer * A solid understanding of secure SDLC - what good looks like and where the evidence lives * Strong risk management foundations (ISO 31000, COSO or comparable) and the ability to present risk to C-level stakeholders in business terms * A hands-on, delivery mindset: you define what needs to be done, then do it, scaling your effort to the deadline * Excellent communication and presentation skills in English (C1); German is a plus * Based in Vienna or willing to relocate, with regular on-site presence and full presence during audits * Relevant certifications (ISO 27001 Lead Implementer / Lead Auditor, CISM, CISSP, CISA) and experience with modern GRC platforms (e.g. Vanta, Drata) are strong pluses ## Description Millions of people interact with fiskaly every day, even if they don't realize it. As a B2B company, we power the retail technology behind digital receipts and secure, legally compliant transactions. By making receipts tamper-proof through digital signatures, we help fight tax fraud. And with our paperless receipt solution, we offer consumers a modern alternative while helping merchants streamline their operations. Sure, our solutions sound complex but our mission is simple: make receipts easy for everyone. The Role fiskaly is certified to ISO 27001, and our re-certification audit is scheduled for early 2027. We're looking for an Information Security & Compliance Manager to take end-to-end ownership of our ISMS: close the open nonconformities from our last audit, mature the management system, and lead us through re-certification - then keep raising the bar as we scale across seven European markets. This is an ownership role, not a coordination role. You set the direction - what needs to happen, in which order and why - and you deliver a good part of it yourself: improving processes, running internal audits, preparing evidence and sitting in the room with the auditors. Towards our management team you are the independent expert voice on security and compliance; towards Engineering, Product and Legal you are the hands-on partner who makes controls work in a cloud-native SaaS environment. Beyond ISO 27001, you'll look after our ISO 9001 quality management system and our GDPR framework, and keep us ahead of NIS2 and the AI Act. ️ What You'll Do * Own our ISMS end-to-end - scope, policies, controls, risk register, management review and continuous improvement - and be accountable for its effectiveness, not just its documentation * Lead our re-certification in early 2027: assess the current state (previous findings, existing policies and processes, gaps), close the open nonconformities, plan and run internal audits, prepare the management review and the evidence, coordinate with the certification body and be present throughout the audit * Define and build ISMS processes tailored to fiskaly - business continuity, change management, incident and vulnerability management, supplier management - designed for how a cloud-native engineering team actually works, not copied from a template * Run the company-wide risk management programme, translating abstract risks into prioritised, actionable engineering and business tasks, and explaining business risk vs. technical risk to leadership * Be the independent expert voice towards management: report on the state of security and compliance, explain what our processes are for, and give concrete direction on what to improve and in which order * Partner with Engineering and Product to embed security-by-design into the SDLC, CI/CD and infrastructure-as-code, and move evidence collection from manual gathering to automated, continuous monitoring wherever possible * Support Legal and Sales on customer due diligence: security questionnaires, contract security reviews and enterprise customer audits * Oversee vendor risk management with lightweight, scalable assessments that surface third-party risk without stalling procurement * Maintain our ISO 9001 QMS and GDPR framework, monitor the regulatory landscape (NIS2, AI Act) and translate it into practical roadmaps for leadership * Drive a security-aware culture beyond mandatory training - position compliance as a business enabler, not a blocker ## Related Videos - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Developer Tools for Microsoft Azure](https://www.wearedevelopers.com/videos/450-developer-tools-for-microsoft-azure) - [The Cloud is Calling: Answer with In-Demand Skills](https://www.wearedevelopers.com/videos/945-the-cloud-is-calling-answer-with-in-demand-skills) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Develop enterprise-ready applications for Microsoft Teams with Azure resources on modern web technologies](https://www.wearedevelopers.com/videos/187-develop-enterprise-ready-applications-for-microsoft-teams-with-azure-resources-on-modern-web-technologies) ## Related Articles - [IT Salaries in Austria](https://www.wearedevelopers.com/magazine/286-it-salaries-in-austria) - [Austria – the most livable place for software developers?](https://www.wearedevelopers.com/magazine/20-austria-the-most-livable-place-for-software-developers) - [The 12 Best Jobs for Software Engineers](https://www.wearedevelopers.com/magazine/401-the-12-best-jobs-for-software-engineers) - [Best Companies to Work For in Austria: Top 25 Companies in 2023 ](https://www.wearedevelopers.com/magazine/192-best-companies-to-work-for-in-austria-top-25-companies-in-2023) - [How to Find Tech Jobs in Vienna](https://www.wearedevelopers.com/magazine/292-how-to-find-tech-jobs-in-vienna) - [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market)