Information Security Auditor (all genders)

Languages: English & German - Technical expert: With a strong hands-on technical background, you understand the complexity of today's IT landscapes, the challenges of securing them properly, and the common pitfalls in design and implementation. Your experience helps you identify weaknesses and problems in technical areas such as network partitioning, server hardening, access management systems, encryption, backup and recovery strategies, and IT operations. You are familiar with traditional IT operations as well as all forms and levels of cloud computing. Ideally, you have successfully administered, operated, and managed an SMB IT landscape. - Look behind the curtain: Seeking out the unknown with an investigative mindset is your specialty. You are resistant to the «what you see is all there is» bias. You can spot evasive answers and won't be fooled by them. - Tenacity and diligence: You can confidently distinguish between observation, requirement, recommended action, and root cause, and describe them fluently and in a consistent format. You diligently gather all necessary evidence to support your recommendations and justify any findings of noncompliance. You prepare and compile your reports to good standards. - Data-driven: Your reports are based on facts from the tools and the evidence you collect. You know how to effectively generate and extract reports from the tools at your disposal, both to inform your own decisions and to provide concise and excellent reports to the Information Security Officer, and the SERRALA personnel at all levels with whom you interact. - Experience with GRC tools: It would be good if you have previously managed compliance using an integrated tool (such as SAP GRC, ServiceNow, Hyperproof, OneTrust). - Information security standards expertise: Experience with additional information security standards and certifications (BSI IT-Grundschutz, BSI C5, CC) is a plus. - Personal certification for auditing: Evidence of certified knowledge of auditing methodology would be good. An ISO 27001 Lead Auditor or CISA certification would be a plus.