Information Security Manager – BCM & Awareness
Thyssenkrupp · Budapest
thyssenkrupp is an international industrial and technology group with around 98,000 employees. In the fiscal year 2023/2024, the company generated sales of €35 billion in 47 countries. Its business activities are bundled in five segments: Automotive Technology, Decarbon Technologies, Materials Services, Steel Europe and Marine Systems. With extensive technology know-how, the businesses develop innovative solutions for the challenges of the future, especially in the fields of climate protection, the energy transition, digital transformation in the industry and mobility of the future.
In the Hungarian development center with our engineering team of 1000 we are present as an innovative and significant partner in one of the fastest growing and most exciting segment of the automotive industry, in the field of electromechanical steering systems. With outstanding quality and high-tech developments we meet the needs of renowned car manufacturers and our developments can be found in 25 % of the manufactured cars all over the world. Our engineers work on new challenges that can change the future of automotive.
As Information Security Manager – BCM & Awareness, you are accountable for business continuity management for information and IT services and for the security awareness program within the Business Unit Bilstein Motion Solutions across three legal entities and more than 25 plants. You ensure that critical business and production processes can be maintained or restored within agreed recovery objectives after and during severe IT or cyber incidents, and that our employees act as an effective line of defense against cyberattacks.
You translate the continuity and awareness requirements of TISAX, ISO/IEC 27001, NIS2, IATF contingency planning and our customers into tested recovery capabilities, practiced crisis procedures and a measurable awareness program.
- Business continuity: Define the BCM methodology in line with ISO 22301, ISO/IEC 27031 and BSI Standard 200-4, conduct business impact analyses with process and plant owners – with a focus on customer supply (JIT/JIS call-offs, EDI, shipping) – and maintain continuity plans, including manual workarounds for production and logistics.
- IT service continuity: Derive recovery requirements for critical IT services such as Active Directory, ERP, MES and EDI platforms, and ensure that IT and the managed IT service provider test disaster recovery plans regularly, including ransomware-resilient backup concepts.
- Crisis management: Maintain the cyber crisis management framework – crisis organization, escalation chains, scenario playbooks and out-of-band communication – aligned with Infrastructure Security Operations, the Cyber Defense Center and OEM notification obligations.
- Exercises: Plan and conduct a risk-based exercise program, from management tabletop exercises to technical recovery tests, in line with IATF requirements for testing contingency plans.
- Security awareness: Own the annual awareness program with target-group-specific learning paths, e-learnings, phishing simulations, multilingual campaigns, shop floor formats and prototype protection briefings.
- Training: Deliver information security training for management bodies as required by NIS2 and role-based training for IT administrators, staff and plant management.
- Reporting and evidence: Define BCM and awareness KPIs and provide audit-ready evidence for TISAX, ISO/IEC 27001, IATF and customer audits.
- Education: University degree in Information Security, Computer Science, Business Administration or a comparable field, or an equivalent professional qualification.
- Experience: Minimum of five years of professional experience, including at least three years in business continuity, IT service continuity or crisis management.
- BCM standards: Proven practical experience with ISO 22301 or BSI Standard 200-4, in particular business impact analyses, continuity plans and exercises.
- IT recovery: Solid understanding of IT infrastructure and recovery (backup and restore, Active Directory recovery, ERP and MES dependencies), sufficient to challenge recovery plans.
- Awareness: Experience in designing and running security awareness programs, including phishing simulations and e-learnings.
- Automotive: Experience in an automotive or manufacturing environment, ideally including contingency planning and JIT/JIS supply processes, and knowledge of the continuity and awareness requirements of ISO/IEC 27001, TISAX and NIS2.
- Communication: Excellent communication and facilitation skills for audiences ranging from executive management to the shop floor.
- Availability: Readiness to support outside regular working hours during major incidents and crisis exercises, as required.
- Languages: Business fluent English (C1), German is an advantage.
- Certifications: ISO 22301 Lead Implementer or Lead Auditor, BCI CBCI, CBCP or SANS SSAP.
- OT: Familiarity with OT environments and IEC 62443.
- A modern office in the 11th district is waiting for you to support your creativity with fun community places, cafe rooms, an own cinema and a skybar
- We support you with flexible working hours and home office opportunity
- Competitive salary and wide range of other benefits (cafeteria & bonus) are provided to you
- You can be part of a successful and growing company in the field of technology
- You can learn new languages in small groups, selecting from 5 languages
- We organize leisure time activities (board games, sport activities)