Information Security & Compliance Officer (f/m/d)

Short Description

You'll support and grow into owning SPREAD's information security and compliance program: ISO 27001, SOC 2, and TISAX, alongside the technical and IT operations that keep it running. You inherit a working program, three live certifications, and an established evidence base, not a blank slate. As you take on more of each certification cycle independently, the scope and title grow with you toward full ownership of the program.

Your Mission

• Support ISO 27001, SOC 2 Type II, and TISAX audit cycles end-to-end, building on our existing evidence base, and take on more ownership of each cycle as you grow into the role.
• Answer customer and OEM security questionnaires directly with the GTM team, turning security review into a reason deals close.
• Present ISMS status and audit results directly to SPREAD's leadership team each cycle.
• Maintain the risk register, policies, and vendor and supplier security assessments, keeping the whole program audit-ready year-round.
• Run security awareness training and phishing simulations across the company.
• Administer identity and access: provisioning, access reviews, conditional access, and RBAC, kept as audit evidence for the program above.
• Manage device and endpoint lifecycle across the company: procurement, enrollment, repair, and retirement.
• Own end-user IT support and the full joiner-mover-leaver process: ticket queue, onboarding and offboarding, and the office network.
• Automate repetitive IT and evidence-collection work in Vanta and beyond, in line with how SPREAD approaches automation across the business.

Your Experience

• 3 to 5 years of hands-on experience in IT operations, InfoSec operations, or a compliance-adjacent IT role.
• Direct experience supporting a full ISO 27001 or SOC 2 audit cycle, evidence collection and auditor liaison included.
• Currently working, or recently worked, in a small security or compliance function alongside a senior person above you.
• Strong, hands-on identity and access management (Entra ID or comparable IdP): provisioning, access reviews, conditional access, RBAC.
• Strong M365/Exchange Online administration and Mac-first endpoint management.
• Comfortable owning an end-user support queue and the full joiner-mover-leaver process.
• Fluent German proficiency and eligibility to obtain a German security clearance or equivalent.
• Bonus: Direct exposure to TISAX or the automotive OEM security ecosystem.
• Bonus: Scripting or automation skills and the instinct to remove repetitive work.
• Bonus: Exposure to Vanta or a similar compliance platform.

Why SPREAD?

• You're joining a security program that's already protecting deals with some of the biggest names in automotive, with a clear path to owning it fully.
• High ownership and measurable impact. You connect your work directly to the success of the organization.
• A senior team that values craft, speed, and accountability over process and hierarchy.
• Strong overall package including attractive compensation, VSO and an annual learning budget.
• Mobility and wellbeing support through a Deutschlandticket mobility budget, bike-leasing and an Urban Sports partnership.
• Time off and flexibility with 30 vacation days, and one paid volunteering day per year.

Contact

[email protected]

SPREAD AI

Köpenicker Str. 40c | 10179 Berlin

Stay connected-follow us on LinkedIn for the latest insights and updates