Customer Information Security Manager (maternity cover)

We are looking for a Customer Information Security Manager to join our team at ARIS in Sofia, Bulgaria.

In this role, you will lead key activities across customer security assurance and third-party risk management, helping customers, prospects, and internal stakeholders understand ARIS’ security, privacy, compliance, and risk management practices.

You’ll work closely with teams across security, legal, sales, customer success, and engineering to support customer due diligence, supplier reviews, RFPs, renewals, and enterprise security requirements.

Essential Functions:

Lead responses to customer security questionnaires, vendor assessments, RFPs, and due diligence requests

Support customer security reviews for prospects, existing customers, renewals, and enterprise accounts

Participate in customer calls to explain security controls, compliance posture, and risk management practices

Manage third-party risk reviews for suppliers, vendors, and partners

Review supplier security documentation, certifications, policies, and risk responses

Track supplier risks, exceptions, follow-ups, and remediation actions

Maintain accurate customer-facing security documentation, standard responses, and supporting evidence

Respond to questions relating to security controls, certifications, subprocessors, data handling, access management, incident response, and business continuity

Partner with legal and internal stakeholders to review security-related contractual commitments

Identify opportunities to improve security assurance, documentation, and third-party risk processes

Minimum requirements:

Experience in information security, GRC, compliance, customer assurance, vendor risk, third-party risk management, or a related role

Experience managing customer security questionnaires, due diligence requests, and supplier risk assessments

Good working knowledge of frameworks and standards such as ISO 27001, SOC 2, GDPR, NIST, or similar

Ability to discuss SaaS/cloud security, access controls, encryption, vulnerability management, secure development, incident response, data retention, subprocessors, and supplier risk with confidence

Awareness of current customer expectations around AI, third-party tools, software supply chain risk, and data protection

Strong written and verbal communication skills, with the ability to engage both technical and non-technical stakeholders

Sound judgement, attention to detail, and the ability to manage competing priorities

Confidence working cross-functionally with security, legal, sales, customer success, and engineering teams

Nice to have:

Experience with Drata or similar compliance automation platforms

Experience in a SaaS, technology, or other cloud-based environment

Experience supporting ISO 27001, SOC 2, C5 or similar audits

Relevant security, risk, or audit certifications such as CISSP, CISM, CISA, ISO 27001 lead implementer/auditor, or similar

Experience improving security response libraries, trust documentation, or third-party risk management processes

Experience working with a customer-facing trust centers or security assurance portals

Benefits

25 working days' annual leave — 5 above the statutory minimum — rising with tenure through the loyalty programme

Supplementary private health insurance (Groupama) covering outpatient, hospital, dental, vision and preventive care, with family members addable

MultiSport card, co-funded by ARIS, for gyms and sports facilities nationwide

Monthly Edenred gift card

€700 one-time work-from-home allowance on joining

Hybrid working — up to 3 days from home per week — with a free secured office parking space