Consultant Information Security / IT Security Governance

Project overview

For our client, we are looking for an experienced consultant in the field of information security and IT security governance to support the creation, further development, and harmonization of security policies and regulations. The focus is on the security requirements for software solutions, external software components, and AI-assisted developed software. Furthermore, the project includes the security assessment of complex IT architectures, especially in the environment of SAP CPI and Cloud/SaaS solutions.

Your Activities

The Profile Sought

• Analysis of existing security policies and draft regulations, as well as identification of deviations from BSI IT-Grundschutz, ISO/IEC 27001, and other regulatory requirements
• Creation, revision, and harmonization of information security policies for software solutions and external software components
• Definition of security requirements for cloud and SaaS solutions, software supply chains, and AI-assisted software development
• Elaboration of verifiable and auditable policy texts, including concrete recommendations for action
• Development of security requirements for software procurement, tenders, and contract design
• Creation and updating of checklists, risk assessments, audit evidence, and audit templates
• Coordination of security regulations with relevant specialist departments and incorporation of specialist feedback
• Support in assessing complex security issues, particularly in the area of SAP CPI / SAP Integration Suite
• Consulting on regulatory requirements such as EU Cyber Resilience Act, NIS2, and § 393 SGB V
• Several years of professional experience in information security, IT security governance, or IT security consulting
• Sound knowledge of BSI IT-Grundschutz and ISO/IEC 27001:2022, as well as practical experience in creating security policies and regulations
• Certification as BSI Grundschutz Practitioner, BSI Auditor, ISO 27001 Lead Implementer, or comparable qualification
• Experience with § 8a BSIG proofs and knowledge of industry-specific security standards (B3S)
• Knowledge in the area of Software Supply Chain Security, especially SBOM, Software Composition Analysis (SCA), and BSI TR-03185-2
• Experience with the security assessment of cloud and SaaS solutions
• Basic knowledge of the security architecture of SAP CPI or SAP Integration Suite
• Ability to translate complex security requirements into understandable, practice-oriented, and auditable regulations
• Independent, structured, and analytical way of working, as well as strong communication skills

Project details

• Start: 2026-11-15
• Duration: 15.11.2026 - 31.03.2027
• Remote: remote
• Location: Remote, DE
• Languages: German, English