Information Security Expert (m/f/d)

Every day, our people need to understand why security matters – and when IT fails, ALPLA needs to be ready. As Information Security Expert, you make both happen. You own our security awareness and our IT Emergency Organisation (ITEO), assess information security risks across IT and OT, lead streams within our information security programme TRUST and prepare the evidence for our Cyber-assessments. You report to the CISO and work closely with colleagues in business, IT and OT across our regions and plants.

At the core:

• Take ownership of Security Awareness at ALPLA and drive trainings, phishing simulations and communication campaigns that foster a strong security culture
• Lead and continuously improve ALPLA's IT Emergency Organisation (ITEO), including processes, roles, documentation and exercises
• Conduct information security risk assessments in IT and support security assessments in OT environments together with subject matter experts
• Lead and coordinate workstreams within our global Information Security programme TRUST
• Collaborate with stakeholders across Business, IT and OT to advance ALPLA's security maturity
• Support compliance with security standards and regulatory requirements such as ISO 27001 and NIS2
• Prepare documentation and evidence for audits, cyber security assessments and compliance reviews

You own your topics end to end, including the budget for Awareness and the ITEO, and keep the CISO informed on status and KPIs. The overall ISMS, external audits and reporting to management stay with the CISO, so you can concentrate on your topics.

You take over security awareness and the ITEO from day one. Risk assessments, audit support and your TRUST streams follow step by step over your first year, with coaching from experienced colleagues in the team.

What you bring

• At least two years of experience in information security or security-related IT, for example identity and access management, incident response or security operations
• A degree in a technical, scientific or business field, or a comparable qualification
• Experience with service ownership, incident response or emergency management
• A knack for communication: you explain security clearly to very different audiences, in English and German
• Good knowledge of information security management systems and frameworks such as NIS2, ISO 27001 and NIST, and an understanding of how security works in both IT and OT
• Experience in project or programme work
• A structured, independent way of working: together we set priorities, you take ownership and see things through

Nice to have

• First experience with risk assessments or audits
• Experience in an industrial company
• Certifications such as ISO 27001 Lead Implementer or Lead Auditor, CISM, CISA or CISSP