Your challenge As our Senior ICT Risk Manager / Information Security Officer (all genders), you are responsible for the information security and ICT risk governance at Hubject Financial Services GmbH (HFS), a BaFin-licensed payment service provider (PSP) established in 2024. In this key position, you hold the dual mandate as the Information Security Officer (ISO) and the ICT Risk Control Function under DORA, operating within the second line of defense.  Your mission: strengthen HFS’s security posture, digital resilience, and governance maturity while contributing to our growth as a regulated FinTech at the intersection of payments and e-mobility. Why Hubject Financial Services  Why Hubject <ul><li>We are a newly BaFin-licensed payment institution backed by Hubject GmbH — the global market and innovation leader in e-mobility services</li><li>We operate at the intersection of payments, regulation, and e-mobility infrastructure, serving a fast-growing ecosystem of charge point operators, e-mobility providers, and partners across Europe You join a small, senior expert team, where your decisions have immediate impact and you help build governance structures from the ground up</li><li>HFS benefits from being embedded in Hubject GmbH — backed by major industry players from the automotive, energy and technology sectors (BMW, Bosch, Mercedes, EnBW, Enel, E.ON, Siemens and Volkswagen) — giving our company the foundation to build cutting-edge payment services for e-mobility.</li></ul>We also offer benefits across: <ul><li>Food &amp; drinks (food subsidy)</li><li>Mobility (BVG subsidy)</li><li>Health &amp; sports (Urban sports membership M)</li><li>Learning and development (yearly training budget and Udemy learning platform access)</li><li>Hubject Lifestyle (Voiio membership)</li><li>Family-friendly environment (flex working time)</li></ul> Your Tasks You will shape the ICT risk and security governance of a newly established BaFin-regulated PSP from the ground up a rare opportunity in the German financial sector including:   ICT Risk and IS Governance &amp; Management Framework<ul><li>Take formal responsibility as the Information Security Officer (ISO) and as the ICT Risk Control Function under DORA, ensuring effectiveness of HFS’s ICT and cyber risk management framework.</li><li>Establish, operate, and continuously improve the Information Security Management System (ISMS) in alignment with ISO/IEC 27001, DORA, and business and risk strategy, ensuring appropriate policies, controls, and awareness measures are in place. </li><li>Define Hubject FS ICT Risk Management Framework, including ICT risk taxonomy, scenarios and risk appetite.</li><li>Ensure that all ICT risk-related processes are consistently designed and executed.</li><li>Provide independent challenge to first-line assessments and ensure transparency of ICT risk exposure for management and supervisory body. </li></ul>Incident Management &amp; ICT Resilience<ul><li>You coordinate the Local Security Incident Response Team (LSIRT) and act as the central contact for information security incidents, ensuring appropriate escalation, documentation, and regulatory notifications. </li><li>Support ICT operational resilience by aligning incident, continuity and recovery processes with DORA requirements.</li></ul>Policies, Standards  and Security Culture <ul><li>Ensure that  ICT and security policies, standards, and documentation are consistent, up to date, and embedded effectively across all departments. </li><li>Design and deliver awareness and training programs on information security and ICT risk topics, fostering a strong security and resilience culture across HFS. </li></ul>ICT Third-Party Risk Management <ul><li>Perform and review third-party and ICT-outsourcing risk assessments, ensuring external providers and intra-group services meet security and operational resilience in line with DORA and internal standards.</li><li>Contribute to ICT operational resilience by reviewing and challenging Business Impact Analyses (BIA), critical function mapping, and ICT Business Continuity and Disaster Recovery plans in line with DORA requirements</li><li>Ensure oversight of continuity and recovery testing, validate outcomes, and follow up on remediation measures to guarantee readiness and resilience</li><li>Align ICT-BCM governance with HFS’s risk appetite, incident management practices, and outsourcing arrangements</li></ul>Reporting, Audit and Supervisory Interaction <ul><li>Prepare and deliver ICT risk and security reports for internal governance bodies, auditors, and supervisory authorities, ensuring a clear and consistent communication of the institution's ICT risk profile. </li><li>Contribute to internal/external audits and BaFin inspections through clear analyses, professional reporting, and proactive recommendations.</li></ul>Group Coordination <ul><li>Collaborate closely with the ISO of Hubject GmbH to ensure consistent alignment of ICT security and risk management practices across the group.Collaborate closely with the ISO of Hubject GmbH to ensure consistent alignment of ICT security and risk management practices across both organizations. </li></ul> Your Profile Professional Background <ul style="list-style-type:disc;margin-left:0px;"><li style="margin-left:24px;font-family:Verdana , Geneva , sans-serif;">7+ years of professional experience in ICT risk management, information security, or operational resilience, within a financial-services or fintech environment.</li><li style="margin-left:24px;font-family:Verdana , Geneva , sans-serif;">Expert knowledge of DORA, ISO/IEC 27001, and information-security best practices.</li><li style="margin-left:24px;font-family:Verdana , Geneva , sans-serif;">Proven experience in establishing, managing, and improving an ISMS, including ICT and third-party-risk control processes.</li></ul>Soft skills <ul style="list-style-type:disc;margin-left:0px;"><li style="margin-left:24px;font-family:Verdana , Geneva , sans-serif;">Project management skills, with the ability to work collaboratively with cross-functional teams, certifications such as CISSP, CISM, CRISC, CISA are a plus</li><li style="margin-left:24px;font-family:Verdana , Geneva , sans-serif;">Connect ICT, security, business, and regulatory perspectives into a coherent strategic view and anticipates emerging risks and regulatory developments, adapting governance accordingly.</li><li style="margin-left:24px;font-family:Verdana , Geneva , sans-serif;">Excellent communication and stakeholder-management skills; confident in engaging with management, auditors, and supervisory authorities.</li><li style="margin-left:24px;font-family:Verdana , Geneva , sans-serif;">Entrepreneurial mindset and willingness to work hands-on in a small, international, senior expert team.</li></ul> Language Proficiency in written and spoken English; German language skills will be plus Start date April 2026 (or earlier) Location Onsite in Berlin Hybrid system: <ul><li>2 days per week at the office, 3 days remote</li><li>EUREF Campus in Schöneberg in Berlin - Europe's hotspot for green technology and eMobility</li></ul>

We are a global eMobility expert and provide smart business solutions that leverage digital mobility worldwide. Our mission: jumpstart the EV industry and redefine the future of mobility for all of us.
Our offices in Berlin, Los Angeles, and Shanghai stand for great commitment, digital expertise, and a pioneering spirit.

Senior ICT Risk Manager / Information Security Officer (ISO) (all genders)

Your challenge As our Senior ICT Risk Manager / Information Security Officer (all genders), you are responsible for the information security and ICT risk governance at Hubject Financial Services GmbH (HFS), a BaFin-licensed payment service provider (PSP) established in 2024. In this key position, you hold the dual mandate as the Information Security Officer (ISO) and the ICT Risk Control Function under DORA, operating within the second line of defense. &nbsp;Your mission: strengthen HFS’s security posture, digital resilience, and governance maturity while contributing to our growth as a regulated FinTech at the intersection of payments and e-mobility. Why Hubject Financial Services&nbsp; Why Hubject <ul><li>We are a newly BaFin-licensed payment institution backed by&nbsp;Hubject&nbsp;GmbH — the global market and innovation leader in e-mobility services</li><li>We&nbsp;operate&nbsp;at the intersection of payments, regulation, and e-mobility infrastructure, serving a fast-growing ecosystem of charge point operators, e-mobility providers, and partners across Europe&nbsp;You join a small, senior expert team, where your decisions have immediate impact and you help build governance structures from the ground up</li><li>HFS benefits from being embedded in&nbsp;Hubject&nbsp;GmbH — backed by major industry players from the automotive, energy and technology sectors (BMW, Bosch,&nbsp;Mercedes, EnBW, Enel,&nbsp;E.ON,&nbsp;Siemens&nbsp;and&nbsp;Volkswagen) — giving our company&nbsp;the&nbsp;foundation&nbsp;to build&nbsp;cutting-edge&nbsp;payment services for e-mobility.</li></ul>We also offer benefits across:&nbsp;<ul><li>Food &amp; drinks (food subsidy)</li><li>Mobility (BVG subsidy)</li><li>Health &amp; sports (Urban sports membership M)</li><li>Learning and development (yearly training budget and Udemy learning platform access)</li><li>Hubject&nbsp;Lifestyle (Voiio&nbsp;membership)</li><li>Family-friendly environment (flex working time)</li></ul> Your Tasks You will shape the ICT risk and security governance of a newly established BaFin-regulated PSP from the ground up a rare opportunity in the German financial sector including: &nbsp; ICT Risk and IS Governance &amp; Management Framework<ul><li>Take formal responsibility as the Information Security Officer (ISO) and as the ICT Risk Control Function under DORA,&nbsp;ensuring&nbsp;effectiveness of HFS’s ICT and cyber risk management framework.</li><li>Establish,&nbsp;operate, and continuously improve the Information Security Management System (ISMS) in alignment with ISO/IEC 27001, DORA, and&nbsp;business and risk&nbsp;strategy, ensuring&nbsp;appropriate policies, controls, and awareness measures are in place.&nbsp;</li><li>Define&nbsp;Hubject&nbsp;FS ICT Risk Management Framework, including ICT risk taxonomy,&nbsp;scenarios&nbsp;and risk appetite.</li><li>Ensure&nbsp;that all ICT risk-related processes are consistently designed and executed.</li><li>Provide independent&nbsp;challenge&nbsp;to first-line assessments and ensure transparency of ICT risk exposure for management and supervisory&nbsp;body. </li></ul>Incident Management &amp; ICT Resilience<ul><li>You coordinate the Local Security Incident Response Team (LSIRT) and act as the central contact for information security incidents, ensuring&nbsp;appropriate escalation, documentation, and regulatory notifications.&nbsp;</li><li>Support ICT operational resilience by aligning incident,&nbsp;continuity&nbsp;and recovery processes with DORA requirements.</li></ul>Policies, Standards &nbsp;and Security Culture&nbsp;<ul><li>Ensure&nbsp;that&nbsp;&nbsp;ICT&nbsp;and security policies, standards, and documentation are consistent, up to date, and embedded effectively across all departments.&nbsp;</li><li>Design and deliver awareness and training programs on information security and ICT risk topics, fostering a strong security and resilience culture across HFS.&nbsp;</li></ul>ICT Third-Party Risk Management&nbsp;<ul><li>Perform and review third-party and ICT-outsourcing risk assessments, ensuring external providers&nbsp;and intra-group services meet&nbsp;security and operational resilience in line with DORA and internal standards.</li><li>Contribute to ICT operational resilience by reviewing and challenging Business Impact Analyses (BIA), critical function mapping, and ICT Business Continuity and Disaster Recovery plans in line with DORA requirements</li><li>Ensure oversight of continuity and recovery testing,&nbsp;validate&nbsp;outcomes, and&nbsp;follow up on&nbsp;remediation measures to guarantee readiness and resilience</li><li>Align ICT-BCM governance with HFS’s risk appetite, incident management practices, and outsourcing arrangements</li></ul>Reporting, Audit and Supervisory Interaction&nbsp;<ul><li>Prepare and deliver ICT risk and security reports for internal governance bodies, auditors, and supervisory authorities, ensuring&nbsp;a clear&nbsp;and consistent communication of the institution's ICT risk profile.&nbsp;</li><li>Contribute to internal/external audits and BaFin inspections through clear analyses, professional reporting, and proactive recommendations.</li></ul>Group Coordination&nbsp;<ul><li>Collaborate closely with the ISO of&nbsp;Hubject&nbsp;GmbH to ensure consistent alignment of ICT security and risk management practices across the&nbsp;group.Collaborate&nbsp;closely&nbsp;with the ISO of&nbsp;Hubject&nbsp;GmbH&nbsp;to&nbsp;ensure&nbsp;consistent alignment of&nbsp;ICT&nbsp;security and risk management practices across both organizations.&nbsp;</li></ul> Your Profile Professional Background&nbsp;<ul><li>7+ years of professional experience in ICT risk management, information security, or operational resilience, within a financial-services or fintech environment.</li><li>Expert knowledge of DORA, ISO/IEC 27001, and&nbsp;information-security&nbsp;best practices.</li><li>Proven experience in&nbsp;establishing, managing, and improving an ISMS, including ICT and&nbsp;third-party-risk control processes.</li></ul>Soft skills&nbsp;<ul><li>Project management skills, with the ability to work collaboratively with cross-functional teams, certifications such as CISSP, CISM, CRISC, CISA&nbsp;are a plus</li><li>Connect ICT, security, business, and regulatory perspectives into a coherent strategic view&nbsp;and&nbsp;anticipates&nbsp;emerging risks and regulatory developments, adapting governance accordingly.</li><li>Excellent communication and stakeholder-management skills; confident in engaging with management, auditors, and&nbsp;supervisory authorities.</li><li>Entrepreneurial mindset and willingness to work hands-on in a small, international, senior expert team.</li></ul> Language Proficiency in written and spoken English; German language skills will be plus Start date April 2026 (or earlier) Location Onsite in Berlin Hybrid system: <ul><li>2 days per week at the office, 3 days remote</li><li>EUREF Campus in Schöneberg in Berlin - Europe's hotspot for green technology and eMobility</li></ul>

Senior ICT Risk Manager / Information Security Officer (ISO) (all genders)

About the Job

About the Company

Hubject

Similar Jobs

Senior Security and Solution Architect - 1

Senior Security and Solution Architect - 1

IT Security Lead

IT Security Lead

Information Security Officer

Information Security Officer

OT/IT Systems Analyst (Senior) - Operations & Compliance

OT/IT Systems Analyst (Senior) - Operations & Compliance

Director, Information Security

Director, Information Security

Global IT Security Expert - OT

Global IT Security Expert - OT

Global IT Security Expert - IAM

Global IT Security Expert - IAM

Information Security Officer (m/f/d)

Information Security Officer (m/f/d)

Manager, IT Security

Manager, IT Security

Senior Security Analyst (F/M/D)

Senior Security Analyst (F/M/D)