Senior Information Security Manager (GRC)

Job description

# **Meet DeepL** DeepL is a global AI product and research company focused on building secure, intelligent solutions to complex business problems. Over 200,000 business customers and millions of individuals across 228 global markets today trust DeepL's Language AI platform for human-like translation, improved writing and real-time voice translation. Founded in 2017 by CEO Jaroslaw “Jarek” Kutylowski, DeepL now has around 1,000 passionate employees and is supported by world-renowned investors including Benchmark, IVP, and Index Ventures. Our goal is to become the global leader in trusted, intelligent AI technology, building products that drive better communication, foster connections, and create a meaningful impact. To achieve this, we need talented people like you to join our journey. If you’re ready to shape the future of AI and grow your career in a fast-moving, purpose-driven environment, DeepL is your next destination. ## **What sets us apart** What sets us apart is our blend of cutting-edge AI technology, meaningful work, and a culture where people truly thrive. We’re a team of innovators, researchers, and creators driven by a shared purpose to unlock human potential by making work simpler, smarter, and more connected. When we share what it’s like to work at DeepL, the reactions are overwhelmingly positive. This might be because of our technology that helps millions of people and businesses communicate and work better every day, or because of the trust, curiosity, and care that shape our culture. What we know for sure is this: being part of DeepL means joining a team dedicated to innovation, growth, and well-being. Discover more about life at DeepL on[LinkedIn](https://www.linkedin.com/company/deepl/),[Instagram](https://www.instagram.com/deepl_official/), and our [Blog](https://www.deepl.com/en/blog). ## **Meet the team behind this journey** DeepL is looking for a Senior Information Security Manager to strengthen our Governance, Risk, and Compliance (GRC) function. You'll own the day-to-day operation of our information security and compliance program, with a strong focus on ISO 27001 and SOC 2 Type II, and a bonus if you bring HIPAA or BSI C5 experience to the table. This isn't a "gatekeeper" role. We're a SaaS scale-up, and our product teams move fast. We need someone who understands risk well enough to take calculated ones, someone who can say "yes, and here's how we do it safely" instead of defaulting to "no." You'll be the person who keeps compliance moving at the speed of the business, not the person who slows it down. You'll be part of our Information Security team, sitting within the broader Security track alongside the IT Security team, both under our Head of Security. You'll work closely with your teammates in Information Security and IT Security to make sure security and compliance work hand in hand rather than in separate lanes. ## **Your responsibilities** **Program ownership** - Own and continuously improve our Information Security Management System (ISMS), keeping it aligned with ISO 27001, SOC 2 Type II, and, where relevant, HIPAA and BSI C5 - Maintain and mature our risk register, policy library, vendor/third-party risk assessments, and control monitoring **Audits & evidence** - Act as a hands-on participant in audits, working directly with auditors, control owners, and leadership to prepare, execute, and close out certification and attestation cycles efficiently rather than through brute force - Build and refine evidence collection processes using automation and GRC tooling (e.g. Vanta or similar), reducing manual overhead and audit fatigue across the company - Design and roll out a model where product and engineering teams own their evidence throughout the control lifecycle, rather than compliance chasing people down before every audit **Risk & business partnership** - Assess risk pragmatically: identify real security and compliance exposure, size it accurately, and make calculated calls that unblock product and engineering teams - Partner with engineering, product, IT, People, and Legal to embed security and compliance requirements into existing workflows rather than bolting them on afterward - Track regulatory and customer-driven compliance requirements — new customer security questionnaires, evolving frameworks — and translate them into practical, actionable controls **Reporting** - Report on the state of the security and compliance program to stakeholders and leadership, including audit readiness, open risks, and remediation progress ## **Qualities we look for** - 3-5 years of experience in information security, GRC, or compliance roles, ideally at a SaaS company, and ideally at scaleup pace and scale - Hands-on experience running or supporting ISO 27001 and SOC 2 Type II programs and audits, from control design through evidence collection to certification - Experience with HIPAA and/or BSI C5 is a strong plus - Practical experience with GRC/evidence automation tooling such as Vanta (or equivalent), including building smooth, low-friction processes around it - A track record of building processes that shift evidence ownership to the teams generating the evidence, rather than centralizing it all in compliance - Sound risk judgment: comfortable making calculated, defensible risk decisions to keep product teams unblocked, rather than reflexively blocking - Strong stakeholder management skills; able to work credibly with engineers, product managers, and leadership without becoming an obstacle - Fluent English and German language skills at C1 level (or close by) are required - Clear, structured communicator who can translate compliance requirements into language engineering and product teams actually act on ## **What we offer** - **Diverse and internationally distributed team**: joining our team means becoming part of a large, global community with people of more than 90 nationalities. We're more than just colleagues; we're a group of professionals with a shared mission to connect diverse cultures. Our global presence is growing–we've doubled in size nearly every year, with our employees based in the UK, Germany, the Netherlands, Poland, the US, and Japan, and we continue to expand our network. - **Open communication, regular feedback**: as a language-focused company, we value the importance of clear, honest communication. We value smooth collaboration, direct and actionable feedback, and believe that leading with empathy and growth mindset makes us better together. - **Hybrid work, flexible hours**: we offer a hybrid work schedule, with team members coming into the office twice a week. This allows you to engage directly with your team and experience the unique energy of our workspace, while still enjoying the flexibility and comfort of working from home. With flexible working hours and trust in your productivity, we are in sync with your team’s general locations and time zones to foster effective and seamless collaboration. - **Virtual Shares -** An ownership mindset in every role. We believe everyone should share in our success, and that’s why every employee receives Virtual Shares, linking your contribution directly to DeepL’s growth and rewarding you with a stake in our future. - **Regular in-person team events**: we bond over vibrant events that are as unique as our team, from local team and business unit gatherings, to new-joiner onboardings, to company-wide events that bring us all together–literally. - **Monthly full-day hacking sessions**: every month, we have Hack Fridays, where you can spend your time diving into a project you're passionate about and get the opportunity to work with other teams–we value your initiatives, impact, and creativity. - **30 days of annual leave**: we value your peace of mind. With 30 days off (excluding public holidays) and access to mental health resources, we make sure you're as strong mentally as you are professionally. - **Competitive benefits**: just as our team spans the globe, so does our benefits package. We've crafted it to reflect the diversity of our team and tailored it to align with your unique location, to ensure you feel supported every step of the way. If this role and our mission resonate with you, but you're hesitant because you don't check all the boxes, don't let that hold you back. At DeepL, it's all about the value you bring and the growth we can foster together. Go ahead, apply—let's discover your potential together. We can't wait to meet you! #LI-HK1 ## **We are an equal opportunity employer** You are welcome at DeepL for who you are - we appreciate authenticity here. Our product is for everyone, and so is our workplace. The more voices we have represented and amplified in our business, the more we will all succeed, contribute, and think forward! So bring us your personal experience, your perspectives, and your background. It’s in our diversity that we will find the power to break down language barriers in the world.