Required skills
- § 8a BSIG Audits
- KRITIS Audits
- NIST CSF
- ISO/IEC 27001
- Information Security Audits
- Gap Analysis
- Risk Management
- NIS2 Directive
- Security Assessment
- Lead Auditor
Languages: German
Job description
Seeking a Security Assessor with expertise in KRITIS regulations and § 8a BSIG for a cyber security assessment at an energy provider. The role involves evaluating information security maturity and implementation against NIST CSF 2.0 and ISO/IEC 27001:2022.
Project overview
For a cyber security assessment at an energy provider (operator of critical infrastructures, IT and OT), we are looking for a Security Assessor (m/f/d) for KRITIS regulations and § 8a BSIG. Maturity and implementation of information security will be audited according to NIST CSF 2.0 and ISO/IEC 27001:2022 with evidence and spot checks, not just through interviews. The result must be defensible to a § 8a auditor.
Responsibilities
Must-Have Requirements
Desirable
Framework
Application
Please send your profile with the certificate (mandatory, see must-have requirements) and 2-3 relevant references. Please respond by Sunday, October 25, 2026.
- Audit of KRITIS conformity (§ 8a BSIG, NIS2) and comparison with the last § 8a certificate
- Document and evidence review (SoA, risk treatment plan, policies, audit reports)
- Interviews with management and responsible persons
- Contribution to role effectiveness analysis, evaluation, final report, and action catalog
- ABSOLUTE MUST-HAVE CRITERION: Certificate of audit procedure competence according to § 8a para. 3 BSIG (KRITIS audits). The certificate must be submitted with the application; applications without proof cannot be considered.
- Demonstrable maturity/gap assessments at KRITIS operators (documents, interviews, on-site)
- KRITIS regulations (§ 8a BSIG, NIS2): at least 2 years
- Maturity assessments according to NIST CSF and benchmarking: at least 3 years
- ISO/IEC 27001 Lead Auditor (active)
- References from the energy sector or KRITIS, possibly with reference release
- Start: from November 2026, duration approx. 3 months (extendable)
- Scope: approx. 8 person-days, distributed over the duration
- Location: completely remote
- Security: Declaration of commitment and security requirements of the end customer
- Hourly rate: by agreement
Project details
- Start: ab sofort
- Duration: 3 Monate
- Remote: remote
- Location: Frankfurt, Deutschland, DE
- Languages: German
Indexed by 9am's meta-search. You are a job provider? Claim or manage this listing
Found on FreelancerMap DE