The posting
At Aceve, we back the builders of society. Founded in the Nordics and growing across Europe, we build digital tools for the people who construct and maintain our physical world - giving electricians, plumbers, and contractors back their time, clarity, and confidence. With over 900 employees across 8 countries, leading brands in 7 customer markets, and more than €100M in revenue, we're on an ambitious growth journey, and we're just getting started. We're an AI-first company, and we work with grit, openness, and a good dose of joy.
About the role
Aceve is ISO 27001 certified as one group: more than forty products, more than 23,000 customers, eight countries, and we keep growing through acquisition. Customers, auditors and our owners all ask the same question in different words: can you show it? This role is how we answer. You own the ISMS framework, hold the evidence, and check that we actually do what our policies say, so gaps get found before an auditor or a
customer finds them.
But this isn't a role for reciting clauses. When a team asks “what does ISO 27001 want from us?”, you explain what the requirement is trying to protect, then help them find the simplest way of working that achieves it, in their context. You report to the CISO, and your findings go straight to the Cyber Security Steering Committee.
What will you do
Process owners run the controls. You make sure the management system actually works: you test it, explain it, and help teams improve how they work, so that compliance is a result of good practice rather than paperwork done for an auditor. Nobody you work with reports to you, so you'll get things done through trust and follow-through.
• Drive the policy review cycle and keep our governing documents controlled and accessible
• Own the compliance evidence base and control monitoring, and make sure the evidence reflects how we actually work
• Translate requirements into ways of working: advise teams on how to meet ISO 27001, NIS2 and the Cyber Resilience Act, starting from the intent of the requirement and the team's reality, and help them decide how much control is proportionate to the risk
• Keep one management system, not three: map overlapping requirements into a single control set, so teams comply once and we can show it for each framework
• Coach through nonconformities, not just track them: from logging and owner assignment to a real root cause, a proportionate corrective action and verified closure, so we fix the process rather than the symptom
• Run internal audits and process sampling that teach: validate that controls work, show teams what good evidence looks like, and report findings to the Cyber Security Steering Committee every quarter
• Coordinate external audits and certification, and prepare teams to explain their own process and show their evidence with confidence
• Bring acquired companies into the ISMS: our ISMS is the baseline, and you find the smoothest way in for each company, building on what already works there
• Own customer security assurance: keep the trust center and standard answer set current so most questions are answered from them, and answer customer questionnaires and audits from the evidence base, with technical input from your colleagues in cyber
• Follow our compliance posture for ISO 27001, NIS2, the Cyber Resilience Act and each ISAE 3402 report.
Use audit results, nonconformity trends and incidents to find recurring weaknesses, and bring improvements to the Steering Committee, the ELT and the annual Management Review
• Operate the risk register day to day, and perform supplier security risk assessments, following the method set by the Cybersecurity Program & GRC Lead
We believe you have
• Hands-on experience running or auditing an ISO 27001 management system, including evidence, nonconformities, corrective action and audits, from both sides of the table
• A solid grasp of quality management principles: the process approach, PDCA, root-cause analysis and continual improvement, and experience auditing processes, not just checking documents
• Working knowledge of NIS2, or the curiosity to get there fast
• A degree in information security, IT, risk management or a related field, or equivalent practical experience
• Experience with ISAE 3402 or similar assurance reporting, and with work across several entities or countries
• A knack for keeping many small deadlines moving across many owners, and following through until they're closed
• The independence to report a gap plainly, even in entities that see themselves as mature
• A coaching mindset: you explain the purpose behind a requirement in plain words, and teams come out of an audit or nonconformity knowing more about their own process than before
• Clear writing that works for auditors, customers and colleagues who aren't security people
• A pragmatic streak: you know that evidence that's good enough and on time beats a perfect framework nobody uses
Not ticking every box? No worries! We value potential and drive, so apply anyway or connect with us- you might be just what we're looking for in our growing organisation! Join Aceve and take your expertise to the next level, together we are redefining what’s possible in craft and construction solutions!
Aceve is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. Our selection process is conducted continuously and without discrimination, ensuring an equal opportunity for all candidates.
