Security Risk & Compliance Specialist (PID0634)

This is a remote position.

Security Risk & Compliance Specialist (PID0634) ISRC

• Contract / Freelance
  
• Full-time
  
• Remote with travel readiness required (Germany)
  
• Start: 01/06/2026
  
• Senior level
  

About the role

We are seeking a Senior Security Risk & Compliance Specialist to join the Information Security Risk and Compliance function of a large internal platform programme in the energy sector. Working within a cloud-native hybrid platform environment you will translate control objectives and compliance requirements into actionable technical controls and non-functional requirements and provide guidance to product line security champions across the programme.

What youll be doing

• Deriving concrete technical controls from high-level control objectives and frameworks such as NIS2 and ISO 27001
  
• Converting compliance and risk requirements into clear non-functional requirements (NFRs) for product lines and platform architecture
  
• Maintaining the NFR Security category and providing recommendations on definition-of-done for control implementation and testing
  
• Contributing to Product Release Specification (PRS) workflows by validating security-related inputs
  
• Enabling product line security champions and architects to implement requirements in alignment with ISRC governance structures
  
• Providing technical clarification during review cycles and identifying gaps in security-related design decisions
  
• Offering hands-on technical guidance to product lines when deeper analysis is required while ensuring they remain the accountable implementation owner
  
• Collaborating with architects product lines and governance teams to ensure consistent control adoption across the programme
  
• Facilitating communication and enablement activities for new or updated controls
  

Requirements

What youll need

• 3 years of experience in security architecture security engineering cloud security or a related field
  
• Strong grounding in security architecture principles secure design patterns and DevSecOps frameworks
  
• SME-level experience in at least one of the following: Security Architecture and Design Cloud Security Identity and Access Management Application Security DevSecOps and Automation Incident Response and Resilience or Cryptography and Data Protection
  
• Experience translating technical security requirements into actionable designs and documentation
  
• Fluent English spoken and written (C1 minimum)
  

Desirable

• Experience designing and implementing security and compliance controls for platforms
  
• Familiarity with threat modelling methodologies and risk assessment
  
• Experience with DevSecOps practices and tools for integrating security into platform development
  
• Experience with cloud posture management and detection tools (CSPM KSP workload protection)
  
• Knowledge of security and compliance frameworks including ISO/IEC 27001 CSA CCM BSI Grundschutz NIST CSF and NIST OSCAL
  
• Familiarity with sector-specific regulations such as NIS2 CRA KRITIS and BSI C5
  
• Understanding of CNCF-related ecosystems (Kubernetes KeyCloak Kyverno Trivy etc.)
  

Benefits