Cybersecurity role profile

Hire an ISMS Manager

Build, run and improve the ISMS — close to risk, controls and demonstrable evidence

Our IT recruitment team combines IT executive search, specialist IT recruiters and scalable technology recruitment for security-critical hiring.

The ISMS manager operationalises information security: structuring processes under ISO/IEC 27001, maintaining the statement of applicability, steering remediation and preparing audits. In Germany, BSI IT-Grundschutz often shapes the method stack — alongside frameworks such as the NIST CSF.

Regulatory drivers include NIS2 and sector rules (e.g. DORA in finance): the role must translate obligations into controlled work packages and evidence.

Guidance appears in BSI ISMS material and ISO/IEC 27002; threat updates draw on ENISA and BSI reporting.

Hiring success pairs certification experience with the ability to align business and IT — without paper-only compliance.

Hire an ISMS Manager

Role profile

Purpose

Run the ISMS: manage risk, implement controls, sustain certification evidence and continuous improvement.

Typical accountability

ISMS processes, asset and risk registers, remediation, internal audits, alignment with privacy and supplier security.

Example metrics

• Audit outcomes (major/minor findings)
• Remediation plan execution
• Time-to-assess after material changes

Responsibilities in detail

1. ISMS operation and improvement

Maintain policies and standards aligned with ISO/IEC 27001 and organisational policy.

2. Risk, controls and evidence

Steer risk treatment and control testing; use CIS Controls or internal catalogues where adopted.

3. Audit and certification

Prepare external audits and certification cycles; manage findings and corrective actions.

4. Interfaces and awareness

Coordinate with CISO, ISO roles and business units; sustain awareness programmes.

Interfaces

Internal

CISO/ISO
Internal audit
IT operations and projects
Privacy
Procurement

External

Certification bodies
Auditors
critical suppliers

The ISMS manager often bridges strategy and operations — weak mandates break evidence chains.

Qualifications

Professional

ISO 27001/27002 experience; lead auditor/implementer credentials help
GRC tooling and document control
Working knowledge of identity, access and supplier risk

Personal

Structured delivery
Stakeholder communication
Resilience during audit peaks

Salary orientation (Germany)

Benchmarks via Market and comparable sources; regulated environments with certification accountability typically pay premiums.

Hiring challenges

Few profiles combine deep ISMS craft with audit-grade execution; expectations rise with NIS2 roll-out and enterprise policy.

• Consulting competition — permanent roles need a crisp mandate.
• Tool sprawl without governance hurts evidence.
• Matrix organisations require political skill.

More role profiles

See the cybersecurity recruiting overview for all profiles — or jump to related roles:

We also fill roles in industrial IT recruitment — including OT/ICS security, manufacturing IT and industrial architecture.

Hire an ISMS manager

We align certification scope, interfaces and operating model — then curate candidates with demonstrable ISMS execution.

Readable market framing and timely reference checks — without artificial delay tactics.

Find matching candidates