Senior IT Security Manager

You'll take full ownership of information security, compliance, and IT governance at Cosuno. You'll build and run our ISMS, lead us through ISO 27001 certification, and become the face of Cosuno's security posture toward enterprise customers and auditors.

What you'll do

• Lead our ISO 27001 certification from gap analysis through audit, and run the ISMS afterwards: risk management, Statement of Applicability, internal audits, management reviews, and the annual control cycle
• Write and maintain our security policies, making sure they describe how we actually work rather than how a template says we should
• Own responses to enterprise security questionnaires and RFIs, helping Sales close deals faster
• Represent Cosuno in supplier audits by enterprise customers: you'll face customer CISOs and auditors independently, in German or English as needed
• Own the operational side of GDPR: drafting and negotiating DPAs (AVVs), managing our subprocessor list and notifications, running vendor security reviews, and supporting DSARs
• Own our identity and access management via JumpCloud (MDM, SSO, device policies), including joiner/mover/leaver processes and periodic access reviews
• Define our IT security baseline: device hardening, SaaS tooling governance, security awareness training

What you'll need

• Full professional fluency in German and English
• Deep, hands-on ISO 27001 experience; you've built or run an ISMS before, ideally leading a company through certification
• Operational GDPR expertise; you can draft a DPA, know your Art. 28 from your Art. 32, and have handled subprocessor management, vendor reviews, and DSARs in practice
• Genuine technical literacy; you understand how a modern SaaS product is built and run (cloud infrastructure, CI/CD, SaaS tooling)
• Fluency with AI tools in your daily work; you already use tools like Claude, Claude Code, or similar as a core part of how you get things done
• Independence in front of customers; you're comfortable being the sole security counterpart in an enterprise audit or a customer CISO call
• The organisational maturity to run multiple threads in parallel without things slipping

Nice to have

• ISO 27001 Lead Implementer / Lead Auditor certification, or CIPP/E
• Experience with compliance automation tooling (Kertos, Vanta, Drata, Secfix, or similar)
• Experience administering an MDM / IdP (JumpCloud, Okta, Jamf, or similar)
• Prior experience at a B2B SaaS company selling to enterprise customers

What they offer

• Competitive salary above market average, reflecting the seniority of the role
• Work 100% remotely or from our modern office in Berlin, with flexible working hours
• New MacBook Pro to ensure you have the best tools for the job
• Regular company off-sites and team events
• Permanent contract in a stable, well-funded company