Your Scope of Responsibilities

As Chief Information Security Officer (CISO) (m/f/x) of ÖBB-Technische Services GmbH (ÖBB-TS), you will assume an effective steering and governance function for information security. You will be responsible for all aspects of information security, the management and continuous development of the ISMS in accordance with ISO/IEC 27001:2022, and the fulfillment of applicable legal and group-wide requirements, particularly NIS2/NISG 2026. You will ensure compliance and alignment with group security and its guidelines.
This position is not purely a technical security role. The focus lies on strategic management, risk orientation, ISMS governance, organizational development, management consulting, and the sustainable integration of information security in IT, OT, workshops, facilities, locations, digital services, and collaboration with external partners.

Your Job, You ...

• will establish the new Cyber & Information Security organizational unit with clear roles, responsibilities, services, interfaces, and decision-making processes, and further develop your team both professionally and organizationally.
• will coordinate and monitor information security within ÖBB-TS, align the ISMS consistently with the PDCA cycle, and harmonize security objectives with corporate goals and management directives.
• will advise the IT & Digitalization division’s leadership on information security, risks, priorities, investments, strategic guidelines, and necessary decisions.
• will be responsible for the establishment, operation, and continuous development of the ISMS in accordance with ISO/IEC 27001 and will steer the implementation of requirements from NIS2/NISG 2026, RKEG, GDPR, and relevant group-wide guidelines.
• will initiate, coordinate, and manage ÖBB-TS-wide information security risk management, including the inventory and classification of IT/OT assets, as well as alignment with group risk management.
• will define methods, processes, standards, security guidelines, roles, control mechanisms, escalation paths, and KPIs applicable within ÖBB-TS and document these in the relevant ISMS regulatory frameworks.
• will manage and maintain the ÖBB-TS ISMS master document index and coordinate IS regulations applicable across ÖBB-TS, including processes for deviations, non-conformities, exceptions, as well as corrective and improvement measures.
• will establish effective guidelines and processes for security incidents, legal early warnings, and reporting channels, coordinate the central reporting and information office, and promptly inform management in the event of an incident.
• will initiate, coordinate, and oversee IT and OT emergency management and ensure an effective interface with incident, crisis, and business continuity management.
• will lead the ISMS core team, coordinate the ÖBB-TS ISRM Board, formulate tasks for specific IS working groups, and represent the IS organization both internally and externally.
• will support and coach ISOs, IRMs, decentralized ISBs, ISAs, asset owners, workshop and facility managers, and business units in implementing measures and strengthen security awareness through targeted communication and training.
• will manage internal audits, risk analyses, management reviews, and IS performance metrics, and prepare decision-making bases and reports for management.
• will define security guidelines for collaboration with external parties and suppliers and ensure that critical know-how, risk decisions, and governance remain permanently embedded internally.