Information Security Officer

About Us: Mendix, part of Siemens Digital Industries Software, is looking for a proactive Information Security Officer to help protect our information assets, strengthen compliance with evolving regulations, and build a security-first outlook across the organization. It's a phenomenal opportunity to make a real, visible impact on the resilience of our digital infrastructure. What you'll be doing: As an Information Security Officer, you will support a range of operational security activities, including: Control Design & Operating Effectiveness: Assess the effectiveness of existing security controls against defined risks, and flag gaps or improvement areas. Compliance Monitoring & Reporting: Monitor compliance against security frameworks and regulatory requirements (e.g., SOC 1 & 2, ISO 27001, NIST, C5, ISO 42001), conduct gap assessments against applicable laws, regulations, and internal frameworks, and report status and findings to relevant partners. Audit Support: Support internal and external audits by gathering, assessing, and providing vital evidence to demonstrate compliance. Evidence lifecycle management: Handle collection, secure storage and archival of security evidence to ensure its integrity and availability for audits. Policy & Standard Development: Research, establish, and maintain information security policies, standards, and procedures tailored to specific organizational needs and emerging threats. Security Culture & Communication: Communicate security requirements, policy updates, and risk information clearly to relevant teams to support a security-conscious culture. Control Implementation & Maintenance: Collaborate with applicable departments to ensure security controls are successfully implemented, maintained, and continuously optimized. What you'll bring: We're looking for someone with a proven foundation in information security and a proactive, diligent approach. Skills & Qualifications: Experience: 3-5 years of dynamic experience in an Information Security, IT Audit, or Compliance role, with a working understanding of core information security principles and practices. Cloud Security Expertise: Understanding of security controls, and best practices within cloud environments (e.g., AWS, Azure, GCP). Familiarity with cloud security tools is a plus. Framework & Regulation Knowledge: Solid grasp and practical experience with a range of information security standards, frameworks, and regulations (e.g., ISO/IEC 27001 family, GDPR, SOC 2 Trust principles). Enterprise IT Familiarity: Familiarity with enterprise data environments, system integrations, and software development lifecycles (SDLC). Certifications: An active information security certification (e.g., CISM, CISSP, ISO 27001 Lead Implementer, CompTIA Security+) is required. Analytical Thinking: Good analytical and problem-solving skills, with the ability to perform gap analyses and support development of practical solutions. Communication: Clear written and verbal communication skills in English, able to explain security topics to both technical and non-technical audiences. Initiative & Collaboration: High level of initiative, self-direction, and the ability to work independently while also being a strong team player and collaborating optimally across departments.