Information Security Consultant

Project overview

For the information security of a cantonal department in public administration, we are looking for an external consultant for information security. You will provide technical support to the person responsible for information security and ensure that security requirements are systematically checked, documented, and implemented in projects and specialist areas. You will work closely with around 60 application managers and contribute to protecting sensitive information from loss, manipulation, and unauthorized access.

Responsibilities

• Support and training of application managers in the creation of protection needs analyses and ISDS concepts (Information Security and Data Protection)
• Consulting application managers on achieving a defined information security level, as well as formal and content review of ISDS concepts
• Review and enforcement of appropriate information security clauses in contracts, as well as contact with suppliers during supplier selection, contract drafting, and pentests
• Enforcement and follow-up of measures for identified vulnerabilities from pentests and audits
• Verification of the necessity of authorizations based on system excerpts, including sensitization of the affected persons
• Ensuring a uniform, central storage of security documentation, as well as creation and maintenance of overviews and dashboards for documentation, training, contracts, and security vulnerabilities
• Processing and follow-up of tickets, including breaking down complex tickets into subtasks
• Review of the implementation of information security policies and guidelines

Requirements

General Framework Conditions

• Many years of experience in information security and risk management, ideally supplemented by experience with audits
• Several years of practical experience in software development, software procurement, or a comparable role with a strong IT focus
• Completed Master's degree in Engineering (University of Applied Sciences or University) or a degree in a related field with in-depth technical knowledge
• Training or further education in Business Analysis, Requirements Management, agile development projects, and IT Service Management
• Sound knowledge of web and desktop applications (web and API, databases, network fundamentals) as well as practical understanding of technical and organizational information security
• Advantageous: Knowledge in authentication and authorization (SSO, OpenID Connect, MFA, RBAC), Cloud/SaaS, Backup & Recovery, Audit Logs, DevSecOps/Container, OT/SCADA, Mobile, and IoT
• Advantageous: Knowledge of ISO 27001, BSI IT-Grundschutz, IKT-Minimalstandards or NIST CSF, as well as cryptographic methods, BCM, and GRC tools
• Ability to explain security requirements in a target-group-oriented manner and to constructively deal with conflicting goals such as time pressure vs. security
• Responsible, structured, and independent way of working with a high quality standard and enjoyment of collaboration with different stakeholders
• Very good German language skills, both written and spoken

Project details

01.01.2027

up to * working days)

60 %

Aarau

Fully remote possible (weekly on-site meeting)

Language: German

• Start: 2027-01
• Duration: 12 Monate
• Remote: remote
• Location: Aarau, Schweiz, CH
• Languages: German