Head of Cybersecurity (m/w/d)

You own the cybersecurity strategy of the Orca Group and shape how security is embedded across our products, cloud platforms, and engineering processes. As our products increasingly move to the cloud and integrate AI, security is becoming a fundamental part of our product and technology development.

• Develop and own the group-wide cybersecurity strategy and roadmap, creating a transparent view of security risks across our products and companies.
• Establish Security by Design and a secure software development lifecycle through threat modelling, automated security checks, and clear engineering standards.
• Shape our cloud security standards together with Platform Engineering, covering identity, access, networks, and other core cloud components.
• Develop security standards for our AI products and AI agents, addressing risks such as prompt injection, data leakage, permissions, and model supply chain.
• Manage penetration testing, vulnerability management, and incident response, ensuring identified risks are consistently tracked and resolved.
• Drive relevant security and compliance requirements such as ISO 27001, BSI C5, NIS2, the Cyber Resilience Act, and GDPR and translate them into practical technical standards.
• Build and develop our group-wide Security Guild and embed security expertise directly within our Product and Engineering teams.

• Several years of experience in Information Security, including multiple years with responsibility for security in a software, SaaS, or comparable technology environment.
• Proven experience embedding Application and Cloud Security directly into Engineering teams, for example through DevSecOps, threat modelling, and secure SDLC practices.
• Strong hands-on knowledge of Cloud Security, ideally within the Microsoft Azure environment.
• Solid understanding of modern AI and agent security risks and how to mitigate them technically within products.
• Experience with relevant security and compliance requirements such as NIS2, the Cyber Resilience Act, GDPR, and ISO 27001, including their translation into technical processes.
• Ability to establish security standards across an organization and influence Engineering teams without relying on direct line authority.
• Confident communication skills in German (at least C1 level) and English (at least C1 level).
• Nice to have, but not a must: Experience with penetration testing, incident response, security certifications, or security within a multi-company or PE-backed environment.