Customer Information Security Manager (maternity cover)

We are looking for a Customer Information Security Manager to join our team at ARIS in Sofia, Bulgaria.

In this role, you will lead key activities across customer security assurance and third-party risk management, helping customers, prospects, and internal stakeholders understand ARIS’ security, privacy, compliance, and risk management practices.

You’ll work closely with teams across security, legal, sales, customer success, and engineering to support customer due diligence, supplier reviews, RFPs, renewals, and enterprise security requirements.

Essential Functions:

• Lead responses to customer security questionnaires, vendor assessments, RFPs, and due diligence requests
• Support customer security reviews for prospects, existing customers, renewals, and enterprise accounts
• Participate in customer calls to explain security controls, compliance posture, and risk management practices
• Manage third-party risk reviews for suppliers, vendors, and partners
• Review supplier security documentation, certifications, policies, and risk responses
• Track supplier risks, exceptions, follow-ups, and remediation actions
• Maintain accurate customer-facing security documentation, standard responses, and supporting evidence
• Respond to questions relating to security controls, certifications, subprocessors, data handling, access management, incident response, and business continuity
• Partner with legal and internal stakeholders to review security-related contractual commitments
• Identify opportunities to improve security assurance, documentation, and third-party risk processes

Minimum requirements:

• Experience in information security, GRC, compliance, customer assurance, vendor risk, third-party risk management, or a related role
• Experience managing customer security questionnaires, due diligence requests, and supplier risk assessments
• Good working knowledge of frameworks and standards such as ISO 27001, SOC 2, GDPR, NIST, or similar
• Ability to discuss SaaS/cloud security, access controls, encryption, vulnerability management, secure development, incident response, data retention, subprocessors, and supplier risk with confidence
• Awareness of current customer expectations around AI, third-party tools, software supply chain risk, and data protection
• Strong written and verbal communication skills, with the ability to engage both technical and non-technical stakeholders
• Sound judgement, attention to detail, and the ability to manage competing priorities
• Confidence working cross-functionally with security, legal, sales, customer success, and engineering teams

Nice to have:

• Experience with Drata or similar compliance automation platforms
• Experience in a SaaS, technology, or other cloud-based environment
• Experience supporting ISO 27001, SOC 2, C5 or similar audits
• Relevant security, risk, or audit certifications such as CISSP, CISM, CISA, ISO 27001 lead implementer/auditor, or similar
• Experience improving security response libraries, trust documentation, or third-party risk management processes
• Experience working with a customer-facing trust centers or security assurance portals

Benefits

• 25 working days' annual leave — 5 above the statutory minimum — rising with tenure through the loyalty programme
• Supplementary private health insurance (Groupama) covering outpatient, hospital, dental, vision and preventive care, with family members addable
• MultiSport card, co-funded by ARIS, for gyms and sports facilities nationwide
• Monthly Edenred gift card
• €700 one-time work-from-home allowance on joining
• Hybrid working — up to 3 days from home per week — with a free secured office parking space