ISO 27001 Lead Implementer / Lead Auditor – Cyber Security Assessment at Energy Provider

Project overview

For a Cyber Security Assessment at an energy provider (operator of critical infrastructures, IT and OT), we are looking for an ISO 27001 Lead Implementer / Lead Auditor. The core is an ISO 27001 implementation check with evidence collection on three levels: documented, implemented, effective. Only the third level counts for maturity.

Responsibilities

Mandatory Requirements

Desirable

Framework

Application

Please send your profile with the certificate proofs (mandatory, see mandatory requirements) and 2–3 suitable references. Please respond by Sunday, October 25, 2026.

• Derivation of the audit program from the Statement of Applicability and risk treatment plan
• Audit of ISO/IEC 27001:2022 Chapters 4–10 as well as Annex A / ISO 27002
• Definition and execution of samples per control cluster
• Assessment of the implementation level per control (Levels 0–4) and preparation of findings with evidence, risk, target value, and measure
• Assignment of roles to controls (RACI matrix)
• ABSOLUTE MUST-HAVE CRITERION: ISO/IEC 27001 Lead Implementer (active). Proof of certification must be submitted with the application.
• ABSOLUTE MUST-HAVE CRITERION: ISO/IEC 27001 Lead Auditor (active, transition to 27001:2022). Proof of certification must be submitted with the application.
• ABSOLUTE MUST-HAVE CRITERION: Certification or proven qualification ISA/IEC 62443 (e.g., Cybersecurity Fundamentals/Expert). Proof must be submitted with the application.
• Applications without all three certificate proofs cannot be considered.
• ISMS/ISO 27001 (auditing and implementation): at least 5 years
• Demonstrable maturity/gap assessments based on ISO 27001, ideally for KRITIS operators
• Demonstrable OT/ICS project experience according to IEC 62443, ideally assessment of control system environments
• OT/ICS Security (IEC 62443, MITRE ATT&CK for ICS): at least 3 years
• Experience with technical sampling and site inspections
• MITRE ATT&CK for ICS (e.g., ATT&CK Defender) or proof of attack detection use cases
• Experience with NIST CSF and benchmarking
• References from energy, KRITIS, or control technology, possibly with reference release
• Start: from November 2026, duration approx. 3 months (extendable)
• Scope: approx. 8 person-days, distributed over the duration
• Location: completely remote
• Security: Declaration of commitment and security requirements of the end customer
• Hourly rate: by agreement

Project details

• Start: ab sofort
• Duration: 3 Monate
• Remote: remote
• Location: Frankfurt, Deutschland, DE
• Languages: German