Information Security Assurance Expert (all genders)

Purpose of the Role 

To plan, execute, and support independent information security assurance activities across METRO AG and its operating entities. The role provides structured, judgment-driven assessment of the effectiveness, maturity, and alignment of security controls against internal policies, regulatory requirements, and recognized frameworks - enabling informed risk decisions and continuous improvement of the organization’s security posture. 

Key Responsibilities 

• Plan and perform information security assurance reviews, including control design and effectiveness assessments, thematic reviews, and targeted evaluations across IT and OT environments. 
• Assess the design adequacy and operational effectiveness of security controls based on frameworks such as ISO/IEC 27001, ISO/IEC 42001, the NIST Cybersecurity Framework and the NIST AI Risk Management Framework. 
• Identify and document control gaps, non-conformities, and risk exposures with proportionate, actionable recommendations. 
• Provide subject-matter support to internal and external audit functions as required. 
• Collaborate with risk, compliance, and IT teams to track remediation of identified control gaps and ensure timely closure. 
• Prepare clear, concise, and well-evidenced assurance reports and recommendations for senior stakeholders. 
• Provide guidance to entities and departments in preparing for assurance assessments and building control maturity. 
• Support the continuous improvement of the IS assurance program, including methodology, tooling, and automation.