IT Security & Compliance Manager (Part-Time)
VIA HealthTech automates psychotherapy documentation — from session notes to psychological reports — so therapists spend less time on admin and more time with patients.
We work at the intersection of mental healthcare, AI, and software. Security is central to what we build: we process highly sensitive data and already hold C5 and ISO27001 certification.
Aufgaben
We are looking for a hands-on IT Security & Compliance Manager to own our IT Compliance, ISMS, and our IT security setup end-to-end.
This is a broad role in a small team. You will not only maintain policies but also implement systems, configure tools, run audits, and work directly with engineering to make security a practical part of how we build.
In practice, that means:
- Compliance end-to-end: ISO27001 and, most importantly, C5: Audits, evidence, risk management, corrective actions, auditor communication, internal training
- Controls: deciding what a control should be, building it, and verifying that it works
Vanta: keeping it current and accurate as we grow - Internal IT security: you own design and baseline like identity, MDM, device policies, endpoint hardening, access model, on-/offboarding
- SaaS security administration: configuration, permissions, access reviews across our tool landscape
- Coordinating external security work: penetration tests, security reviews, vendor and subprocessor assessments
- Security documentation auditors and customers rely on: TOMs, VVT, AVVs with vendors
Qualifikation
Required:
- You have carried an ISO27001 certification or C5 attestation end-to-end at least once, including audit ownership and auditor communication. C5 matters most to us, but ISO27001 or SOC 2 at that level transfers well. You can design and implement controls, not just document them.
- You have owned internal IT security hands-on — identity, MDM, endpoint baselines, SaaS administration, access model — and you configure systems yourself
- You work directly with engineers on technical security topics and can judge whether a control is effective in a cloud-native, infrastructure-as-code environment
- Pragmatic judgment and strong operational ownership in a small, async-first team
German at working level and fluent English — auditors and clinical customers are in German, our team works in English
Nice to have:
- Healthcare, or another environment handling highly sensitive data
- Experience setting up IT and security in an early-stage or fast-growing company
- German data protection practice: AVV, VVT, TOM, DPIA. We have an external Datenschutzbeauftragter for the legal depth, so this is useful but not required.
What matters beyond the checklist:
We are a 10-person startup. This role needs breadth, ownership, and hands-on execution. ISO27001 and C5 are in place and yours to own. That means maintaining them, keeping Vanta current, and updating controls and policies as we grow. What we don't need is someone to collect evidence. We need someone who decides what a control should actually be, builds it, and can tell whether it works.
We are not looking for someone who only writes policies, but for someone who builds and operates the security and compliance foundation VIA needs as it scales.
The role is part-time given the small team size, but workloads may vary (eg. increased when building certain security features or during the audit periods).
Benefits
- Office in Berlin Mitte, flexible hours
- Direct access to founders, CTO, and the full multidisciplinary team
- Broad ownership over a core company function
- Equity participation
- No micromanagement — results over hours logged
- Work at the intersection of AI, healthcare, software, and security
Find Jobs in Germany on Arbeitnow
Skills
- IT Security
Similar roles
Working Student, Customer Success
Planetlabs·Berlin, Germany
<div class="content-intro"><p><strong>Welcome to Planet. We believe in using space to help life on Earth.</strong></p> <p>Planet designs, builds, and operates the largest constellation of imaging satellites in history. This constellation delivers an unprecedented dataset of empirical information via a revolutionary cloud-based platform to authoritative figures in commercial, environmental, and humanitarian sectors. We are both a space company and data company all…
- On-site
- Full-time
- Blue Card — tied; settle 21–33mo
Applied AI Engineer, Enterprise
anthropic·Munich, Germany
<div class="content-intro"><h2><strong>About Anthropic</strong></h2> <p>Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems.</p></div><h2><strong>About the role</strong></h2> <p>As an Applied AI…
- On-site
- Full-time
- Blue Card — tied; settle 21–33mo
Quantitative Researcher / Signal Generator - Alpha Signal Program
Moreton Capital Partners·Germany
QUANTITATIVE RESEARCHER / SIGNAL GENERATOR - ALPHA SIGNAL PROGRAM ABOUT US We're a small, elite team of AI researchers and engineers building predictive models across commodities, prediction markets, and global macro. We're well capitalized, we move fast, and we care about one thing above all: whether a signal actually works. The Alpha Signal Program is how we bring in talent…
- Remote
- Contract
- Blue Card — tied; settle 21–33mo
System Administrator - MacOS (all genders)
Sunday Natural·Berlin, Germany
YOUR ROLE * You’ll be part of the IT Helpdesk team in Berlin to provide local and remote support to the company employees in Berlin’s offices, in Poland and remotely * You’ll follow our processes and implement new ones as new workflows to save costs and improve efficiency, with according documentation * You are ensuring that our infrastructure are working…
- On-site
- Full-time
- Blue Card — tied; settle 21–33mo
Internship – Regulatory Affairs (all genders)
Sunday Natural·Berlin, Germany
Berlin | Full-time, 40 hours per week | 6 months | Start: October YOUR ROLE We are looking for a motivated Intern for our Regulatory Affairs Team to support our experienced team with the regulatory review of our products and a wide range of research projects. During your internship, you will gain practical insights into regulatory affairs within the food…
- On-site
- Full-time
- Blue Card — tied; settle 21–33mo
Junior Graphic Designer (all genders)
Sunday Natural·Berlin, Germany
YOUR ROLE We are looking for a Junior Graphic Designer who will support the graphic/creative team and help us to make our brand and content stand out from the crowd. In this role, you will create, edit, and manage a variety of assets like icons, promotional social media banners, newsletters, and infographics. You will support the team in the development…
- On-site
- Full-time
- Blue Card — tied; settle 21–33mo
(Senior) Purchasing Manager / Strategic Buyer (all genders)
Sunday Natural·Berlin, Germany
YOUR ROLE As our (Senior) Purchasing Manager / Strategic Buyer you will take full ownership of a defined supplier portfolio or category, ensuring seamless execution within our purchasing process while actively contributing to inventory optimization and operational excellence. * Establish a best-in-class Category Architecture: Design and implement a clear category structure across all spend, identifying key leverage areas, critical dependencies,…
- On-site
- Full-time
- Blue Card — tied; settle 21–33mo
Creative & Paid Social Strategist (d/f/m) - German-speaking
Leapsome·Berlin, Germany
What is Leapsome? Leapsome is the AI-powered people platform revolutionizing HR for modern teams. Leapsome drives HR excellence and empowers high-performing teams by automating, connecting, and simplifying every HR process across the employee lifecycle — from onboarding and performance management to engagement and development. Built with ease of use in mind, our platform ensures high adoption by employees, managers, and…
- On-site
- Full-time
- Blue Card — tied; settle 21–33mo
