Information Security Lead (m/f/d)
TeleClinic · München ·
- Work mode
- Hybrid
- Seniority
- Lead
- Category
- Security
TeleClinic · München ·
pwc · Cairo - ETIC
Corework Staffing · Atlanta, Georgia, United States
Integrant · Cairo, Cairo Governorate, Egypt
Constructor TECH · Singapore
We want to enable the access to digital medical consultation for everyone in Germany. Really for everyone! To reach that, we are building the leading on-demand platform for telemedicine. And your impact matters.
Are you seeking more than just a job, but a meaningful mission that fills you with pride? Welcome! We are TeleClinic, Germany’s leading telemedicine platform.
Digitalisation of the German healthcare system is currently taking off and we offer some seats to join us on this revolutionary journey. Join TeleClinic and play a pivotal role in shaping a healthier society.
Information Security Lead (m/f/d)
This is a hybrid role sitting within our Infrastructure team. You'll own TeleClinic's information security strategy as our de facto CISO, while staying close enough to the engineering to make security real rather than documentary. You'll be the go-to person for all security-related topics, bridging engineering, operations, and leadership. Our ISO 27001 and ISO 9001 certifications are in place — your job is to keep them, extend them, and turn the ISMS into something the whole company actually uses. If you want your security work to have company-wide impact in a regulated healthcare environment, this role is for you.
What You'll Do
Own our ISO 27001 certification end to end — surveillance audits, re-certification, scope changes, and closing findings with our external auditor (our ISMS runs in Vanta).
Coordinate with our ISO 9001 programme so both audit cycles run as one, and help shape what we certify next (e.g. BSI C5).
Run and evolve the ISMS day to day: risk register, control ownership, evidence collection, and the internal audit programme.
Define and implement security policies, standards, and procedures across and with all teams.
Lead risk assessments, threat modelling, and vulnerability management.
Own third-party and vendor risk, from due diligence through to ongoing review.
Monitor the threat landscape and proactively address emerging risks relevant to a regulated healthcare environment.
Collaborate with product teams and infrastructure on architecture decisions with a security-first mindset.
Educate and upskill colleagues on security awareness and best practices.
Contribute hands-on to our Python/Django services where security work calls for it (tooling, automation, remediation).
What You Bring
Several years owning information security in a regulated or audited environment, including direct exposure to external auditors.
Hands-on experience with ISO 27001, ideally having led or significantly contributed to an implementation, re-certification, or surveillance cycle.
Solid understanding of network security, identity & access management, encryption, and secure SDLC.
Experience running third-party and vendor risk management.
Strong communicator who can translate complex security concepts to non-technical stakeholders.
Experience operating within an integrated management system (ISO 27001 alongside ISO 9001 or similar) is a strong plus.
Familiarity with healthcare data regulations (GDPR, potentially HIPAA, or German digital health regulations such as DiGA) is a strong plus.
Proven track record with cloud infrastructure (AWS, GCP, or Azure) and modern DevSecOps practices is a plus.
Python backend engineering experience is a plus.
Fluent in English; German is a plus.
Our salaries are determined based on objective and role-related criteria, aligned with the local market standards of your specific hiring country. Your dedicated recruiter will be happy to provide detailed information about the relevant salary bands prior to your first interview.
#LI-PS1
#LI-Remote
Please note that due to various partnership or legal agreements, some benefits may not be available outside of Germany.
pwc · Zürich