Cyber Security Manager & Security Governance Lead (m/f/d)

BayWa r.e. is the home for change makers. We r.e.think energy – how it is produced, stored and can be best used to enable the global renewable energy transition that is essential to the future of our planet. At BayWa r.e. we effect change globally. With locations in numerous countries, thousands of colleagues are already working across the world, collaborating with local businesses to proactively shape the future of the energy sector.

With a network of over 20 locations worldwide, more than 1,200 employees and over 30 years of experience, the Business Entity Solar Trade within BayWa r.e. group is one of the world's leading distributors of photovoltaic components. Throughout the B2B sector we supply and support our cooperation partners and installers with innovative photovoltaic products.

About the Role

As part of a major IT carve-out and transformation programme, we are building an independent, service-oriented, and future-ready IT organisation based in Tübingen. We are looking for a Cyber Security Manager & Security Governance Lead (m/f/d) to define and drive our cyber security strategy, governance framework, and resilience roadmap.

This is a highly visible role with broad exposure across technology and business functions. You will act as the central link between IT, business leaders, management, and external security partners, ensuring cyber security remains effective, risk-focused, and aligned with business objectives. While operational security monitoring is largely delivered through specialist service providers, you will provide the governance, direction, and oversight that keeps the organisation secure, compliant, and resilient.

• You will define and drive the future cyber security strategy of the organization and act as the central authority for cyber risk, governance and organizational resilience
• Define and drive the cyber security strategy, governance framework, and long-term security roadmap
• Develop and continuously improve security policies, standards, controls, and governance processes across the organisation
• Lead cyber risk management activities, including risk assessments, mitigation planning, exception management, and risk reporting
• Own and maintain the security control framework, ensuring alignment with business, regulatory, and compliance requirements
• Govern vulnerability management processes and drive remediation activities in partnership with service and platform owners
• Lead ISO 27001 governance activities and support audits, compliance reviews, and evidence collection
• Manage and oversee external security providers, including SOC and MDR services, ensuring effective monitoring and service performance
• Govern security incident response processes, major cyber events, escalation procedures, and post-incident improvements
• Drive disaster recovery and cyber resilience governance, including recovery planning, testing, lessons learned, and continuous improvement initiatives
• Partner with IT and business stakeholders to embed security requirements across cloud, workplace, infrastructure, IAM, M365, and application environments
• Champion security awareness initiatives and help foster a strong and sustainable security culture across the organisation
• Play a key role in the IT transformation by shaping the future cyber security operating model and integrating new services securely from day one

• A degree in Computer Science, Information Security, Business Informatics, or a related field, or equivalent professional experience
• Strong knowledge of cyber security strategy, governance frameworks, risk management, vulnerability management, and incident response
• Experience managing security service providers, including SOC, MDR, or outsourced security operations
• Experience supporting audits, compliance programs, and governance requirements within complex organisations
• Strong stakeholder management skills, with the ability to influence and communicate effectively across all organisational levels
• The ability to translate complex technical and security risks into clear business decisions and actionable recommendations
• A strategic, analytical, and structured approach combined with a high level of ownership and accountability
• An entrepreneurial mindset with a focus on enabling business objectives while effectively managing risk
• Excellent English communication skills, both written and verbal. German language skills are an advantage
• Experience with Microsoft security technologies, cloud security environments, transformation programs, carve-outs, or international organisations is highly desirable; certifications such as CISSP, CISM, CRISC, or equivalent are a plus

• Flexible working hours, mobile working and modern workplace equipment
• 30 days of vacation
• Discounted online shopping through our Corporate Benefits Portal
• Hybrid work schedule with possibility to work remotely
• Subsidy for the Germany Ticket, and e-charging stations in the free company parking
• Last but not least: you are driving forward the energy transition as part of a great team and ensuring that our future becomes a little greener

KA1SP_DE