Information Security Risk Management Product Owner (m/f/d

Risk Management Product Ownership & Governance: Define and own the Risk Management Product scope, operating model, roadmap, and KPIs aligned with CIS and GRC strategy. Establish risk governance, decision rights, committees, and escalation paths, and ensure risk management is embedded into business and IT decision-making. Drive delivery of Risk Management initiatives with end-to-end, coordinating activities, milestones, and outcomes directly with stakeholders. Enterprise Information Security Risk Framework & Practices: Define and maintain the risk management framework, including methodology, policy/standard, templates, workflows, risk taxonomy, and impact criteria (risk impact matrices) for group, divisions, companies, and systems. Ensure risk practices are standardized, measurable, and consistently applied.

End-to-End Risk Lifecycle & Risk Register Operations: Operate supported by different information security teams with assigned responsibility for risk management the unified risk register and enable end-to-end risk management activities across group, division and company layers, including risk identification, assessment, treatment decisions, mitigation tracking, POA&Ms, exception management, and formal risk acceptance. Support business and IT risk owners to ensure traceable ownership and timely risk decisions.

Cross-Product Coordination for Risk Assessments & Monitoring: Coordinate risk-related activities across CIS products and services to ensure consistent assessment of inputs, outputs, and handoffs. Aggregate and govern follow-up of risks arising from controls assessments, internal audits, and other security assessments; monitor status, drive closure, and ensure consistent reporting of residual risk.

Risk Reporting & Executive Oversight: Provide visibility of key risks, trends, KRIs, exceptions, and overdue risk decisions through dashboards and reporting. Report risk status and performance to management through relevant committees and governance bodies, and drive continuous improvement based on metrics and lessons learned.