Information Security Manager (ISMS & Compliance) - DC28

YOUR NEW ROLE

This role is for CODE LEAP's client company - JTL-Software

JTL-Software is one of Germany's leading providers of e-commerce and ERP solutions. More than 50,000 retailers rely on JTL every day to run their business. Our global development center in Vietnam is looking for talented people to build the next generation of these products. You'll work in an international team that pairs German software quality and Vietnamese speed to innovate.

JTL-Software runs e-commerce software that our customers run their businesses on. Customers, partners, and stakeholders trust in JTL to secure their information. This role sits in JTL's security team, not in product development.

This role runs JTL's information security management system end-to-end: the ISO/IEC 27001:2022 ISMS, the internal audit programme, the policy and standard framework, the cyber risk register, and security awareness across the company. The goal is to demonstrate that JTL has successfully established processes to continuously improve its security capabilities. This is a hands-on role without management responsibility.

You report to the Director Cybersecurity & IT in Germany. You work with control owners across engineering, IT, and business functions in Germany and Vietnam, and with external auditors. The role includes a daily overlap with German business hours, typically 14:00 to 17:30 Vietnam time.

YOUR EXCITING TASKS

• Run and maintain the ISO/IEC 27001:2022 management system: scope, Statement of Applicability, control ownership, management review
• Prepare for and defend certification, surveillance and recertification audits
• Keep the evidence base current and collectible, and make it repeatable rather than a scramble before each audit
• Plan and run the internal audit programme against the control set
• Write findings that are specific enough to act on, and drive them to closure with the control owners
• Provide factual assurance to the management team
• Own the policy and standard framework: authorship, review cycle, approval, publication, versioning
• Run the cyber risk register: assessment, treatment plans, acceptance decisions, review cadence
• Act as the single point of contact for customer security assessments, questionnaires and due diligence
• Run the response cycle for our investor's portfolio-wide cyber assessment
• Manage third-party and vendor security assessments, and the security half of the vendor onboarding process
• Design and run the security awareness programme, including role-based training
• Measure whether it changed anything, and change it when it did not
  
  

YOUR PROFILE AND YOUR PERSONALITY

• You have personally owned an ISO/IEC 27001 ISMS or a SOC 2 programme and defended it in front of an external auditor, through certification, recertification or surveillance. Only advising or having provided implementation guidance is not enough for this role.
• You have planned and run internal audits, written the findings, and driven them to closure
• You have written a policy and control framework and then operated an ISMS on it for at least a year
• You have run a risk register where real treatment and acceptance decisions were made
• Technical literacy to look at control evidence from an engineer and tell whether it proves the control
• Fluent English, written and spoken
• Willingness to travel to Germany occasionally, for example for onboarding and certification audits
  
  

Nice To Have

• Lead Auditor certification (ISO 27001, IRCA or equivalent)
• German
• Exposure to TISAX, SOC 2, NIS2
• Experience automating evidence collection rather than gathering it by hand
• Familiarity with security controls in a Microsoft cloud estate (Entra ID, Intune, Defender, Azure) and with cloud benchmarks such as CIS
• Experience in a software product company, where the control owners are engineers
  
  

Benefits Await You At Code Leap

• Competitive salary and benets
• Year-end bonus (13th-month salary)
• Generous annual leave of up to 18 days
• Additional premium health insurance
• Enjoy an endless selection of delicious refreshments, including gourmet coffee, beverages, snacks, and fresh fruits, all complimentary
• Sharing session every Friday, come along with lunch
• 1-on-1 coaching with experienced professionals
• Flexible work policy, which provides flexible hours to accommodate personal schedules and commitments
• Dynamic, fun, and agile environment, perfect for sharing and creativity
• Open-minded, kind & humble colleagues
  
  

CONTACT

Come to talk to us at [Confidential Information]

About Us

With our expert teams spread across two continents, CODE LEAP provides innovative software solutions for venture-backed companies and leading enterprise businesses in Germany. Our teams in Berlin (Germany) and Ho Chi Minh City (Vietnam) work hand in hand to develop state-of-the-art solutions of the highest quality.

Because collaborating with the right people is the secret to our successful growth.

We future-proof organizations - be part of it!