Orcrist is building a next generation data intelligence platform using cutting-edge technologies. We're handling petabyte-scale data with sub-second queries. Our product is a Kubernetes‑based platform delivered as B2B SaaS or as a self‑hosted on‑prem solution, including air‑gapped deployments. We enable customers across defense, law enforcement, and enterprise to turn mission-critical data into actionable intelligence.
Role
As the Group Information Security Officer (ISB), you are responsible for the information security strategy, the security program, and the security posture of the Vektor Group – from strategic direction to practical implementation. In doing so, you work closely and operationally with the Director Internal IT, particularly on technical controls and their implementation.
Your core mandate is the ISO 27001 certification based on BSI IT-Grundschutz as well as the implementation of the requirements of NIS-2. You accompany the entire process – from gap analysis and control implementation through audit readiness and ongoing maintenance to the regulatory obligations arising from both frameworks.
We develop AI platforms for customers in the defense and public sectors. Information security is a prerequisite for our business – not an afterthought.
At the same time, we are continuing to build out our security organization in parallel with the growth of the group. In this phase, you work hands-on, as do the leaders: you take care of operational security topics in day-to-day business, support the IT team directly, and take on tasks that go beyond the boundaries of a classic governance role. We are supported by external consultants during the build-out. As the ISMS and the team mature, your focus will shift more towards strategy, governance, and further development.
Your Responsibilities
- You build the group-wide ISMS according to BSI IT-Grundschutz and continuously develop it – including structure analysis, protection needs assessment, modeling, and risk analysis.
- You create and maintain the group-wide security policy and process framework and coordinate company-specific supplements.
- You prepare for and support the ISO 27001 certification, conduct internal audits, and work with external auditors.
- You implement the requirements of NIS-2, in particular reporting processes, evidence management, and tracking of corrective actions.
- You manage risks across technical and organizational areas, assess and prioritize them, and prepare them for management.
- You coordinate external consultants and service providers within the ongoing security program.
- You build and run our security awareness program – from training to continuous awareness-raising.
- You are responsible for planning and further developing our incident response processes and coordinate with IT, Legal, and the responsible leaders in an emergency.
- You assess third-party and vendor risks and carry out security assessments for new tools, service providers, and partners.
- You work closely with the Director Internal IT on technical controls such as access governance, endpoint security, and identity, as well as with Platform Engineering at the interface with Product Security.
- You support sales and customer trust processes, for example with security questionnaires, due diligence requests, and customer audits.
- You monitor further regulatory requirements – including the EU AI Act and Cyber Resilience Act – and derive concrete measures for the group from them.
What You Bring
- You have several years of experience as an ISB or in a comparable responsible role in information security.
- You have solid practical experience with BSI IT-Grundschutz, in particular the BSI standards 200-x and the IT-Grundschutz Compendium – ideally including a completed certification process.
- You have built or managed ISO 27001 programs and know the path from gap analysis to audit readiness from practice.
- You master risk management: you can assess and prioritize risks in a well-founded way and clearly convey complex matters to both technical and non-technical stakeholders.
- You are willing to get hands-on during the build-out phase and not hand over operational topics to others.
- You engage confidently with management, auditors, and customers and can bring together different interests and perspectives.
- You speak German at C1 level or higher and English at B2 level or higher.
Nice to Have
- Certifications such as IT-Grundschutz Practitioner/Consultant, ISO 27001 Lead Implementer or Lead Auditor, CISSP, or CISM
- Experience with security governance across multiple companies or jurisdictions
- Experience in regulated environments, such as defense, the public sector, or critical infrastructure; knowledge of VS-NfD, Geheimschutz, or AQAP is a plus
- Practical experience implementing NIS-2
- Experience with customer-facing security processes, such as pre-sales, security questionnaires, or customer audits
What We Offer
- Remote-first, nationwide in Germany: Work where you work best – with regular team meetings in Berlin and at other offsite locations.
- Flexibility by default: Flexible working hours help you adapt your work routine to your life.
- Your setup, your way: With a personal home office budget, you can set up your workspace in the way that works best for you.
- 30 days of vacation: Take the time you need to recharge and enjoy your free time.
- Growing together: We invest in your personal and professional development.
- Impact is rewarded: Performance bonuses are based on jointly agreed goals and key results.
- A warm welcome: Every new team member receives a Welcome Goodie Bag on their first day.
- Good people, good times: From summer and Christmas parties to regular team meetings – we take time to celebrate together.
- A mission that matters: Work on challenges with a concrete impact on public safety and national security.