{"id":3240145,"url":"https://alion.io/job/bosch-information-security-expert-c","title":"Information Security Expert_C","company":{"id":132,"name":"Bosch","domain":"bosch.com","url":"https://alion.io/company/bosch","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SmartRecruiters","truth_index":{"grade":"B","score":75,"open_postings":1036,"ghost_share":0,"stale_share":0.993,"repost_share":0,"time_to_fill_p50_days":32,"computed_at":"2026-10-27T05:46:45Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Suzhou, China"],"countries":["CN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":29000,"max_usd":67000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2372},"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"GDPR","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"TCP/IP","optional":false},{"name":"Windows","optional":false},{"name":"Zero Trust","optional":false}],"status":"live","first_seen_at":"2026-10-25T12:30:57Z","employer_posted_date":"2026-10-25","last_verified_at":"2026-10-27T06:23:55Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Do you want beneficial technologies being shaped by your ideas? Whether in the areas of mobility solutions, consumer goods, industrial technology or energy and building technology - with us, you will have the chance to improve quality of life all across the globe. Welcome to Bosch.\n KEY RESPONSIBILITIES\n2.1 COMPLIANCE & RISK MANAGEMENT (~40%)\nIndependently own the company’s information security governance program: develop the annual security and compliance roadmap, delivery plan, and resource requests - and be accountable foroutcomes\n\nLead the build-out, operation, internal audit, and external certification of an ISO/IEC 27001 ISMS, driving non-conformity remediation to closure\nOwn China’s Cybersecurity Multi-Level Protection Scheme (MLPS 2.0): classification, registration, gap assessment, and remediation\nOperationalize obligations under the Cybersecurity Law, Data Security Law, and Personal Information Protection Law (PIPL): data classification and grading, PIAs, and cross-border transfer compliance\nEstablish the risk assessment methodology; lead annual risk assessments, ad-hoc assessments, and third-party / supply chain security reviews\nMaintain compliance registers and key risk indicators (KRIs) with a recurring reporting cadence to management and governance forums\nInterface with regulators, customer security audits, and certification bodies; own the full find-remediate-verify-close cycle as the final backstop on remediation quality\nProvide compliance advisory and security review to business, product, and engineering teams, embedding security requirements upstream into processes\nDrive policy rollout and compliance training; track departmental progress and tie results into performance evaluation\n2.2 ENABLEMENT & SECURITY CULTURE (~25%)\nBuild a tiered security training program: compliance and awareness training for all staff, secure development training for engineers, and role-specific training for operations and business teams - integrated into onboarding and annual mandatory curricula\nConduct security awareness campaigns (phishing simulations, security awareness week, case briefings) with measurable effectiveness evaluation and continuous improvement\nAuthor and maintain company-level policies, technical standards, and security baselines; own rollout, Q&A, and adoption checks\nEstablish durable culture mechanisms: departmental security liaisons / security champions, security performance indicators, positive incentives, and violation reporting\nDeliver presentations and training to varied audiences (executives, engineers, all staff), translating professional requirements into clear language and executable actions\nTrack global regulatory developments and technology trends; produce decision-ready recommendations and internal knowledge assets\n2.3 SECURITY ARCHITECTURE & ENGINEERING (~15%)\nContribute to security architecture planning and evolution; define technical requirements driven by compliance and risk control objectives and carry them through to delivery\nLead or drive implementation of key controls: IAM / SSO, account and privilege governance, data encryption and masking, key management, endpoint and cloud security baselines\nConduct security reviews of major initiatives (cloud migration, core system re-architecture, new business launches); produce risk findings and remediation requirements, and follow through to resolution\nParticipate in security product selection and PoC validation; author company-level security baselines and technical specifications\n2.4 PENETRATION TESTING & RED TEAMING (~10%)\nOwn authorized penetration testing of critical business systems and the external attack surface: develop the annual test plan, manage external vendors, and control delivery quality\nReview test plans, execution, and reports; be able to reproduce and verify common vulnerabilities and judge whether remediation is genuinely effective; drive closure and re-testing\nConduct secure code reviews and software composition analysis (SCA); follow through on vulnerability remediation\nOrganize red team / purple team exercises and convert results into defensive improvements and training material\n2.5 DETECTION & INCIDENT RESPONSE (~10%)\nDrive detection capability: specify detection scenario requirements, follow through on rule implementation and false-positive suppression, and raise discovery rates for adversarial behavior\nEstablish and maintain alert severity classification, incident handling SOPs, and emergency response plans; conduct regular drills and post-incident reviews\nParticipate in triage, coordination, and root-cause review of major security incidents; deliver incident reports and drive remediation\nDrive full-lifecycle vulnerability management and remediation tracking; coordinate with the operations team and enforce remediation SLAs\n 3.1 BASIC REQUIREMENTS\nBachelor’s degree or above; Information Security, Computer Science, Network Engineering, or Information Management preferred\n4+ years of information security experience, including 3+ years independently owning security governance, compliance, risk, or a security program\nAn IT background: substantive work or project experience in networking, systems operations, software development, or cloud; able to review technical designs and engage effectively with engineering\nHas led the build-out of an ISO 27001 / MLPS / data compliance program and taken it through external audit or regulatory inspection to full closure\n3.2 TECHNICAL BACKGROUND & HANDS-ON CAPABILITY\nThis role is governance-led and does not carry a heavy offensive workload - however, it requires genuine technical grounding: understand it, verify it, hold the line. Engineering teams must not be able to explain away deficiencies.\nIT Fundamentals: Understand the TCP/IP stack and common network architectures; familiar with Linux and Windows security mechanisms and hardening essentials for common middleware and databases\nTechnical Comprehension: Grasp Zero Trust, IAM/SSO, data encryption and masking, key management, and cloud-native / container security principles and control objectives; able to review whether a technical design satisfies compliance and security requirements\nVulnerability & Attack Knowledge: Familiar with OWASP Top 10, MITRE ATT&CK, and common vulnerability mechanics; able to reproduce and verify common vulnerabilities and judge whether a fix effectively closes the issue (no unknown-vulnerability research expected)\nTooling: Able to independently use common security tools for baseline checks - vulnerability scanning, configuration baseline review, asset and port discovery, account and privilege review - and to interpret scan reports and alerts\nData Handling: Working Python / Shell scripting for register maintenance, data reconciliation, and automated compliance checks\n3.3 GOVERNANCE & COMPLIANCE CAPABILITY\nDeep knowledge of ISO/IEC 27001, ISO/IEC 27701, MLPS 2.0, GDPR, and China’s cybersecurity and data protection legal framework; able to translate clauses into actionable controls and audit checkpoints\nProven ability to independently lead program build-out, conduct internal audits, manage external certification, and drive non-conformity remediation\nHands-on experience in risk assessment, data classification and grading, PIAs, and vendor security assessments\nSubstantive experience independently leading regulatory inspection responses and customer security audits\n3.4 ENABLEMENT & TRAINING CAPABILITY\nHas independently built an enterprise security training program or security awareness campaign\nAble to design curricula, deliver training, and conduct rollout sessions; adjusts depth and framing for different audiences (executives, engineers, all staff)\nStrong writing skills; able to independently produce policies, compliance reports, training materials, and executive-level briefings\n3.5 INDUSTRY CERTIFICATIONS (KEY SCREENING CRITERION)\nCandidates should hold at least one certification below. As this is a governance-led role, management-track and compliance/privacy certifications are preferred; technical certifications serve as supporting evidence.\nInternational - Governance: CISSP, CISM, CISA, CRISC, CCSP\nChina - Compliance: CISP (CISE / CISO), CISAW, MLPS evaluatorcertification, CCRC credentials\n\nPrivacy: IAPP CIPP/E, CIPM, CIPT, ISO 27701 qualifications\nTechnical Capability: CEH, Security+, OSCP, GPEN, GWAPT\nCloud Security: Alibaba Cloud / Tencent Cloud / Huawei Cloud securitycertifications; AWS Security Specialty, Azure Security Engineer, CCSK\n\n3.6 SOFT SKILLS\nOperates independently: develops plans, coordinates resources, and drives results without requiring step-by-step direction\nStrong cross-functional influence: builds consensus between business velocity, engineering efficiency, and compliance red lines - and drives remediation to closure\nCommunicates and trains effectively: explains risk to executives, requirements to engineers, and expected behavior to all staff\nBalances principle with pragmatism: uncompromising on red lines, flexible on implementation\nStrong documentation skills: independently produces policies, designs, reports, and training decks ready for review\nEnglish reading ability to work with original regulations and standards is a plus\n======================================================================\n4. NICE TO HAVE\nISO 27001 Lead Auditor (LA / LI) or certified internal auditor qualification\nIndependent teaching, corporate trainer, or industry speaking experience\nCompleted delivery of a data security governance or personal information protection compliance program\nTrack record leading a major regulatory inspection or large-scale security remediation program\nFirst-hand experience in IT operations, development, or cloud platform delivery\nContribution to national, industry, or group-level standards\n By choice, we are committed to a diverse workforce and are an equal opportunity employer. Robert Bosch welcomes and encourages applications from people with disabilities. Accommodations are available on request for candidates taking part in the selection process.","description_format":"text","description_chars":10068,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Sensors & Transducers","Industrial Automation","Information Security","HVAC & Refrigeration"],"lifecycle":[{"event":"open","at":"2026-10-25T15:17:42Z"}],"visa":[],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":1,"expected_fill_days":32,"reasons":["conf:3","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-10-27T05:46:45Z"},"pay":null,"html_url":"https://alion.io/job/bosch-information-security-expert-c","json_url":"https://alion.io/job/bosch-information-security-expert-c.json","meta":{"generated_at":"2026-10-27T09:48:14Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11138,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-28T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":132},"rest":"https://alion.io/mcp/rest/get_company?id=132"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fbosch-information-security-expert-c"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fbosch-information-security-expert-c"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fbosch-information-security-expert-c"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/bosch-information-security-expert-c\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fbosch-information-security-expert-c"}]}