Interim Information Security NIS2 Lead

What it’s about NeXtWind operates and repowers wind farms in Germany, with a growth target of 3 GW by 2028. As an operator of energy infrastructure, we are classified as an "entity of particular importance" under the NIS2 Directive and the German IT Security Act (BSIG), and we have been registered with the Federal Office for Information Security (BSI) since March 2026. For us, information security is not a side issue—it is a mandatory requirement. We are looking for an experienced professional to join us for a period of several months to take ongoing responsibility for information security and NIS2 compliance within our Data & IT team, ensuring continuity in this function. IT operations (infrastructure, Microsoft 365 administration, and support) are managed by a separate Corporate IT role, which will join the team starting in December 2026. Your focus will be on security, compliance, and governance, while working in close collaboration with the Corporate IT team. We are not looking for someone who needs a long onboarding process to understand what needs to be done. We need someone who can identify critical issues within the first week, propose priorities, and deliver results independently. 

Your responsibilities 1. NIS2 obligations and reporting 

 You will serve as the primary point of contact for the BSI, ensuring that NIS2 reporting deadlines (24 hours, 72 hours, and one month) are met.

  You will refine our reporting processes and incident response plan, ensuring they are operational and well-practiced—including conducting a tabletop exercise with the executive management team.

  You will assess security incidents and initiate statutory reporting whenever necessary. 2. ISMS, risk management, and roadmap 

You will manage the 2026/27 security roadmap, prioritizing initiatives by assigning owners and setting deadlines. 

You will drive the development of our Information Security Management System (ISMS), including defining roles and committees, establishing a reporting cadence, and maintaining the risk register. The goal is the reliable fulfillment of NIS2 obligations.

 You will implement the mapping of measures for NIS2/BSIG and maintain a verifiable record of the implementation status. 3. Governance and Reporting 

You will prepare the quarterly InfoSec report for the management team.

 You will coordinate IT security policies and security requirements for service providers with our external legal counsel. 

 You will address inquiries regarding information security from investors, insurers, and auditors. 

 You will assign security-related work packages to Corporate IT and external service providers, and provide technical sign-off upon their completion. 4. Documentation and Handover 

 You will document security-related knowledge—such as incident reporting chains, responsibilities, and processes—to ensure it is not dependent on a single individual, and you will provide an organized handover to the permanent successor at the end of your assignment. Overview of Ongoing Tasks Frequency Task Ongoing Evaluate security incidents, prepare and submit statutory notifications to the BSI (Federal Office for Information Security), and serve as the point of contact for the BSI. Weekly Check-in with the team lead (priorities, pending tasks, blockers); maintain the task list in Airtable. Monthly Coordinate with Corporate IT and service providers on security-related topics. Quarterly Prepare the InfoSec report for management; update the risk register. Annually Conduct risk analysis, facilitate a tabletop exercise with management, review policies, and develop a roadmap for the following year. As needed Address inquiries regarding information security arising from due diligence processes, investors, insurers, or auditors. Key Focus Areas for the First 90 Days 

Weeks 1–2: Onboarding, access provisioning, and gaining an overview of pending tasks and deadlines; ensuring a clear understanding of the security incident reporting chain and confirming your availability in the event of an emergency. 

By Day 30: The status of reporting processes and the incident response plan has been reviewed and is operational; outstanding mandatory tasks have been prioritized and scheduled.

  By Day 60: The ISMS kick-off and security roadmap have been aligned; the risk register and the mapping of NIS2-related measures have been updated.

By Day 90: A tabletop exercise has been conducted, an InfoSec report has been prepared, and the documentation and handover plan for the permanent successor are in place. Your Profile What you bring to the table 

Several years of experience in IT security, with responsibility for compliance and risk management. 

Practical experience with NIS2/BSIG (implementation, not just theoretical knowledge). 

Experience with incident response, reporting processes, and the development or further evolution of an ISMS.

 A solid understanding of Microsoft 365 security, enabling you to define requirements and provide technical sign-off on implementations carried out by Corporate IT. 

you work independently and reliably, meet deadlines, maintain thorough documentation, and drive tasks to completion. You provide proposed solutions, not just status updates. 

You are able to explain security topics in an accessible way to executive management and business departments. 

Fluent in German, with a good command of English. Available on short notice. An advantage 

Experience in the energy sector or within a critical infrastructure (KRITIS) environment.

 Certification as an Information Security Officer; familiarity with ISO 27001/27005 methodologies.

 Previous experience in interim or project-based roles that included a clear handover to a permanent successor. Collaboration You will work closely with the Team Lead for Data & Operations Platform and serve as the point of contact for executive management, the legal department, external legal counsel, IT service providers, and auditors. The Corporate IT function is responsible for infrastructure.