The posting
Our mission:
Are you an information security professional who wants to make a real impact across a decentralized organization? You'll drive the development of our ISMS, ensure compliance with ISO 27001, and work closely with teams to turn security requirements into practical, sustainable solutions.
At Open-Xchange (OX), we develop open-source communication and collaboration software used by public sector organizations, telcos, and hosting providers to keep data secure and under their control. Our products cover email, collaboration, DNS security, and related services, and are used by millions of people worldwide.
Discover what OX offers you:
- We work in a non-hierarchical organization that empowers everyone to take responsibility, stay focused, and contribute directly to the company’s success and customer value.
- We value expertise and continuous professional development. Our professionals work closely with experienced colleagues, take ownership of their work, and continuously expand their skills.
- Openness and diversity are core to OX. Different perspectives, backgrounds, and ways of thinking strengthen our collaboration and help us see the bigger picture.
Your team:
Working closely with Engineering, Cloud Operations, and IT Architecture, you'll help embed information security as an integral part of our products and processes. You'll create transparency around technical and organizational security measures, continuously develop our Information Security Management System (ISMS), and advise our Management Board on relevant information security matters. In doing so, you'll help ensure that security is actively considered and effectively implemented across all areas of OX.
Your new job:
Run the ISMS and ISO 27001
- Coordinate the identification and documentation of technical and organizational security measures across the OX Group, working with the responsible cells to keep documentation consistent, up to date, and traceable.
- Drive the continuous development of our ISMS by establishing sustainable governance structures, clear responsibilities, and aligned security processes and policies across the OX Group, ensuring their consistent application within our decentralized organization.
- Plan, coordinate, and support internal and external ISO 27001 audits as well as risk-based supplier assessments and audits. Coordinate the resolution of audit findings and track the implementation of agreed measures together with the responsible cells.
Make security work in a decentralized organization
- Harmonize security requirements and processes across different software landscapes, taking varying levels of maturity and risk profiles into account. Support operational cells with clear guidance, practical templates, and targeted advice, while operational ownership remains with the respective cells.
- Support product cells in identifying and assessing information security risks, document the assessment results within the ISMS, and recommend appropriate measures and risk-based priorities in close coordination with the relevant risk owners.
- Embed Security by Design across our product portfolio, working closely with DevSecOps and product cells to define security requirements and risk-based priorities early in the development process, including through joint information security sprints. Implementation and operation of security tooling remain with the responsible technical cells.
Handle regulation and customers
- Coordinate the assessment of relevant requirements arising from NIS2 and the Cyber Resilience Act (CRA) with the responsible functions and translate them into aligned security, evidence, and reporting processes, including clear responsibilities for operational implementation.
- Capture and negotiate customer information security requirements and align them with the relevant product cells and business functions.
Your background:
- A degree in Computer Science, Business Information Systems, IT Security, or a comparable qualification, such as several years of relevant professional experience in information security, IT risk management, or IT compliance.
- Practical experience in establishing, implementing, and certifying an Information Security Management System (ISMS) in accordance with ISO 27001. Knowledge of the German BSI IT-Grundschutz framework is a plus.
- Experience assessing regulatory security requirements and translating them into practical technical and organizational requirements. Knowledge of NIS2 and the Cyber Resilience Act (CRA) is an advantage.
- Ideally, experience introducing or further developing cross-functional security processes in decentralized organizations with varying levels of technical and organizational maturity, combined with openness to working in an environment without traditional hierarchical structures.
- A solid understanding of software and cloud architectures, secure software development, and technical security measures, as well as experience working with engineering, architecture, and operations cells.
- A structured and analytical approach, combined with practical experience in assessing information security risks and deriving appropriate measures and priorities.
- Clear and convincing communication skills, strong subject-matter expertise, and the ability to explain complex topics in an accessible and audience-appropriate way, including to the Management Board. You are also able to assess customer information security requirements, represent them clearly, and coordinate them with product cells and customer-facing functions.
- Excellent written and spoken German and English.
This is what you get at OX:
- The flexibility to work 100% remotely ensures a work environment that suits you best.
- Flexible working hours that allow you to successfully combine your home and family responsibilities with work.
- Getting together in-person for workshops and fun team events.
- Time off to volunteer – and mental health support when you need it.
- We provide financial relief through corporate benefits and a subsidy for ergonomic chairs and desks.
- We can discuss further location-related benefits together in an initial talk.
Join the team:
Join us in our fight for an open internet and deliver added value! Click “Apply now” to submit your application.
Your contact person:
Reach out to Justin ([email protected]) from the People Team. He will be able to discuss current opportunities and tell you more about our exciting vision and mission @OX.
