Job
- Level
- Lead
- Ort
- Berlin
- Arbeitsmodell
- Hybrid, Onsite
- Job Feld
- IT, Security
- Anstellung
- Vollzeit
- Vertragsart
- Unbefristetes Dienstverhältnis
Job Zusammenfassung
In dieser Position entwickelst du ein umfassendes Sicherheitsprogramm, überwachst die Infrastruktur-Entscheidungen, führst Vulnerability Management durch und bist für Incident Response sowie die Kommunikation mit Kunden verantwortlich.
Job Technologien
Deine Rolle im Team
- You'll be our first dedicated security engineer: a senior IC with no team at the start. You join as Deputy CISO, report to our Director of Technology (currently acting CISO), and build security engineering from scratch. The baseline is already in place - ISO 27001, C5 Type II, regular penetration tests, and encryption in the product. AI is adding new surfaces: voice documentation, document generation, and agentic workflows. You build and own the security program, the tooling, and the security story we tell customers.
- Vulnerability management - scanners and dependency updates across repos, plus the process that gets findings closed.
- Partner to Platform - review security-sensitive infrastructure decisions and explore options like customer-managed keys or HSMs. Platform still owns architecture.
- Certifications, technical side - control design and assessments for our ISO 27001 and C5 setup, the security case for a potential upcoming Class IIa medical device (MDR), and pentest scoping and follow-up, with regulation like the EU Cyber Resilience Act on the horizon. This is roughly a quarter to a third of the role, and we say it openly: for the right person in healthcare security, it's a draw, not a chore.
- Customer security - reusable docs, evidence, and AI-assisted questionnaires, so the tenth enterprise deal costs a fraction of the first. You join the call when a hospital CISO asks something new about our AI architecture.
- Incident response - process, runbooks, and escalation, and you lead when it's real. We're too small for a SOC, so you design on-call that fits a company our size. Product incidents and platform bugs have their own owners in engineering.
- Company-wide security - watch the threat landscape, turn this week's supply-chain mess into concrete actions, and set the baselines IT applies to devices and accounts.
Unsere Erwartungen an dich
Qualifikationen
- You've been the technical counterpart through at least one ISO 27001, C5, or SOC 2 certification cycle: you've designed controls, faced an auditor, and written the technical side of a Statement of Applicability. This is a hard requirement.
- You've run vulnerability management somewhere real: scanners, dependency bots, triage, and the follow-through that gets things fixed.
- You follow the security scene closely (podcasts, advisories, incident write-ups) and usually have an opinion on this week's incident before it reaches the news.
- You're genuinely curious about AI security - both securing AI systems (agents, sandboxing, data flows) and using AI tooling to work at leverage.
- You can talk to engineers, auditors, and hospital security teams in English without a slide deck translating for you.
Erfahrung
- You're a hands-on security engineer with 6+ years across software and security engineering, and you can point to a security program (or a big part of one) you've owned.
Unser Angebot
- Purposeful work - your role will have a positive impact on patients, their families, and healthcare professionals.
- Company culture - we believe in flat hierarchies that promote high performance and strong team dynamics. We foster an environment characterized by mutual respect, loyalty, and recognition. Together, we strive for our goals - and expect the same from you.
- Flexibility - want to pick up your child from daycare? Like to exercise during lunch? We'll support you. We are a remote-friendly company offering flexible working hours. Workations are also possible by arrangement.
- Edenred card - which you can use according to your needs.
- Extra vacation day - so you can celebrate your birthday with your loved ones, you'll have the day off.
Benefits
Work-Life-Integration
Themen mit denen du dich im Job beschäftigst
Job Standorte
Das ist dein Arbeitgeber
Recare Deutschland GmbH
Recare Deutschland GmbH ist ein modernes Health-Tech-Startup mit Sitz in Berlin, das eine digitale Plattform zur Vernetzung von Krankenhäusern, Pflege- und Rehaeinrichtungen anbietet. Das Unternehmen optimiert administrative Prozesse und fördert die Zusammenarbeit entlang der Versorgungskette durch KI-gestützte Workflows, insbesondere im Entlassmanagement. Mit einer Plattform, die viele Akutkrankenhäuser und Rehakliniken integriert, leistet Recare einen Beitrag zur Effizienzsteigerung im Gesundheitswesen.
Description
- Unternehmenstyp
- Startup
- Arbeitsmodell
- Full Remote, Hybrid, Onsite
- Branche
- Gesundheitswesen, Soziales
Lead Security Engineer
- Ort
- Berlin
- Arbeitsmodell
- Hybrid, Onsite
- Diversität
- Für alle Personen geeignet (m/w/d)
