Information Security Manager – Governance, Risk & Compliance
Thyssenkrupp · Budapest
thyssenkrupp is an international industrial and technology group with around 98,000 employees. In the fiscal year 2023/2024, the company generated sales of €35 billion in 47 countries. Its business activities are bundled in five segments: Automotive Technology, Decarbon Technologies, Materials Services, Steel Europe and Marine Systems. With extensive technology know-how, the businesses develop innovative solutions for the challenges of the future, especially in the fields of climate protection, the energy transition, digital transformation in the industry and mobility of the future.
In the Hungarian development center with our engineering team of 1000 we are present as an innovative and significant partner in one of the fastest growing and most exciting segment of the automotive industry, in the field of electromechanical steering systems. With outstanding quality and high-tech developments we meet the needs of renowned car manufacturers and our developments can be found in 25 % of the manufactured cars all over the world. Our engineers work on new challenges that can change the future of automotive.
As Information Security Manager – Governance, Risk & Compliance, you are accountable for information security governance, risk and compliance management of the Business Unit Bilstein Motion Solutions across three legal entities and more than 25 plants. You ensure a transparent and audit-proof view of the requirements we fulfill – including TISAX, ISO/IEC 27001, NIS2 and OEM customer-specific requirements – of the information security risks we carry, and of the decisions taken to treat, transfer or accept them.
You safeguard the TISAX labels on which OEM nominations and the exchange of development and prototype data depend, translate regulatory and contractual requirements into effective controls for IT, OT and the plants, steer the audit program and ensure that suppliers and service providers meet the same standard.
- Risk management: Define and continuously improve the risk management methodology in line with ISO/IEC 27005 and ISO 31000, moderate risk assessments for IT services, plants, OT environments, projects and outsourcing arrangements, and maintain the BU-wide risk register through to treatment or formal risk acceptance.
- Compliance management: Maintain the compliance register covering TISAX (VDA ISA), ISO/IEC 27001, NIS2 and its national implementations, GDPR interfaces and OEM customer-specific requirements, and evaluate information security clauses in OEM supply contracts, quality agreements and non-disclosure agreements.
- TISAX: Manage TISAX end-to-end – participant registration and assessment scopes in the ENX portal, assessment planning per site and assessment objective, timely label renewal and sharing of results with OEM customers.
- Audit management: Plan and coordinate certification audits, run the internal ISMS audit program across all legal entities and plants, and drive findings and corrective actions through to closure.
- Third-party security: Own the information security lifecycle for suppliers and service providers, define TISAX label requirements for sub-suppliers and development partners, and flow down OEM requirements together with Procurement and Legal.
- Governance: Maintain the information security policy framework and the exception process, define information security KPIs, prepare the ISMS management review and align the ISMS with IATF 16949, data protection management and ISO/IEC 42001.
- Stakeholder management: Act as the central point of contact for plant and regional ISOs, IT and plant management, and report the risk situation to the Global Information Security Officer and executive management.
- Education: University degree in Information Security, Computer Science, Business Informatics or a comparable field, or an equivalent professional qualification.
- Certifications: ISO/IEC 27001 Lead Auditor or Lead Implementer, CISM, CISA, CRISC or CISSP.
- Familiarity with IATF 16949, OT security (IEC 62443) and product cybersecurity (ISO/SAE 21434, UNECE R155).
- Experience: Minimum of five years of professional experience in information security, including at least three years in ISMS governance, risk or compliance management.
- ISMS: Proven experience in operating or auditing an ISMS based on ISO/IEC 27001, including risk assessment and risk treatment.
- TISAX: In-depth knowledge of TISAX and the VDA ISA catalogue, ideally including prototype protection, and practical experience in preparing and supporting TISAX assessments.
- Regulation: Knowledge of NIS2 and its national implementations as well as of GDPR interfaces.
- Automotive: Experience with OEM customer-specific requirements, information security clauses in automotive supply contracts and supply chain security risk management.
- Working style: Analytical, structured and independent; confident in multicultural environments and in presenting complex topics concisely to executive management.
- Languages: Business fluent English (C1); German language skills are an advantage.
- A modern office in the 11th district is waiting for you to support your creativity with fun community places, cafe rooms, an own cinema and a skybar
- We support you with flexible working hours and home office opportunity
- Competitive salary and wide range of other benefits (cafeteria & bonus) are provided to you
- You can be part of a successful and growing company in the field of technology
- You can learn new languages in small groups, selecting from 5 languages
- We organize leisure time activities (board games, sport activities)