Purpose of the Role
To plan, execute, and support independent information security assurance activities across METRO AG and its operating entities. The role provides structured, judgment-driven assessment of the effectiveness, maturity, and alignment of security controls against internal policies, regulatory requirements, and recognized frameworks - enabling informed risk decisions and continuous improvement of the organization’s security posture.
Key Responsibilities
- Plan and perform information security assurance reviews, including control design and effectiveness assessments, thematic reviews, and targeted evaluations across IT and OT environments.
- Assess the design adequacy and operational effectiveness of security controls based on frameworks such as ISO/IEC 27001, ISO/IEC 42001, the NIST Cybersecurity Framework and the NIST AI Risk Management Framework.
- Identify and document control gaps, non-conformities, and risk exposures with proportionate, actionable recommendations.
- Provide subject-matter support to internal and external audit functions as required.
- Collaborate with risk, compliance, and IT teams to track remediation of identified control gaps and ensure timely closure.
- Prepare clear, concise, and well-evidenced assurance reports and recommendations for senior stakeholders.
- Provide guidance to entities and departments in preparing for assurance assessments and building control maturity.
- Support the continuous improvement of the IS assurance program, including methodology, tooling, and automation.