ISMS & Assurance Manager

At Aceve, we back the builders of society. Founded in the Nordics and growing across Europe, we build digital tools for the people who construct and maintain our physical world - giving electricians, plumbers, and contractors back their time, clarity, and confidence. With over 900 employees across 8 countries, leading brands in 7 customer markets, and more than €100M in revenue, we're on an ambitious growth journey, and we're just getting started. We're an AI-first company, and we work with grit, openness, and a good dose of joy.

About the role:
Aceve is ISO 27001 certified as one group: more than forty products, more than 23,000 customers, eight countries, and we keep growing through acquisition. Customers, auditors and our owners all ask the same question in different words: can you show it? This role is how we answer. You own the ISMS framework, hold the evidence, and check that we actually do what our policies say, so gaps get found before an auditor or a customer finds them. You report to the CISO, and your findings go straight to the Cyber Security Steering Committee.

What will you do:
You’ll lead how our ISMS works across every entity in scope, and you’ll prove it. Process owners run the controls. You keep the framework alive, test that it’s followed, and turn the evidence into clear answers. Nobody you work with reports to you, so you’ll get things done through trust and follow-through.

• Drive the policy review cycle and run document control: numbering, versions, the document register and publication

• Own the compliance evidence base and control monitoring, and administer the control survey process

• Coordinate nonconformities from logging and owner assignment through root cause, corrective action and verified closure

• Sample processes, run internal audits and validate that controls work, then report findings to the Cyber Security Steering Committee every quarter

• Keep an eye on our compliance posture for ISO 27001, NIS2, the Cyber Resilience Act and each ISAE 3402 report, and feed quarterly input to the Steering Committee, the ELT and the annual Management Review

• Coordinate external audits and certification, and bring acquired entities into the ISMS and evidence base once scope is decided

• Answer customer security questionnaires and customer audits from the evidence base, and keep the trust center and standard answer set current

• Run the security awareness programme with our awareness partner, from phishing simulations to onboarding training, and measure it on outcomes

• Operate the risk register day to day, and perform supplier security risk assessments, following the method set by the Cybersecurity Program & GRC Lead

We believe you have:

• Hands-on experience running or auditing an ISO 27001 management system, including evidence, nonconformities and audits

• A degree in information security, IT, risk management or a related field, or equivalent practical experience

• Experience with ISAE 3402 or similar assurance reporting, and with work across several entities or countries

• A knack for keeping many small deadlines moving across many owners, and following through until they’re closed

• The independence to report a gap plainly, even in entities that see themselves as mature

• Clear writing that works for auditors, customers and colleagues who aren’t security people

• A pragmatic streak: you know that evidence that’s good enough and on time beats a perfect framework nobody uses.

Not ticking every box? No worries! We value potential and drive, so apply anyway or connect with us- you might be just what we're looking for in our growing organisation! Join Aceve and take your expertise to the next level, together we are redefining what’s possible in craft and construction solutions!

Aceve is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. Our selection process is conducted continuously and without discrimination, ensuring an equal opportunity for all candidates.