AI & SDLC Risk Manager (f/m/d) (AI)

Location: Frankfurt am Main, Germany

Company

hirify.global operates a financial market infrastructure, with Group ICT Risk overseeing ICT risks across the group as a second line of defence.

What you will do

• Drive operational resilience through Shift Left security in development, Shift Down platform security, OSCAL, infrastructure-as-code, Terraform, and Shift Right vulnerability management and patching.
• Assess AI and cloud systems used in trading, clearing, and risk environments for adversarial ML, prompt injection, data poisoning, and uncontrolled agent behaviour.
• Evaluate Secure Software Development Lifecycle maturity against frameworks including IEC 62443-4-1 and the Cyber Resilience Act, and challenge CI/CD security controls such as SAST, DAST, SCA, and container scanning.
• Support the SQUARE post-quantum cryptography initiative through crypto inventories, assessment of NIST PQC standards, and migration-readiness reviews.
• Conduct DORA-compliant application risk assessments, track observations, and follow up on remediation with first-line engineering teams.
• Support DORA, BaFin, and internal audits and contribute to EU AI Act implementation with product teams and first-line functions.

Requirements

• Background in software engineering or computer science, including shipped software, code-reading ability, and practical understanding of CI/CD pipelines.
• At least 2 years of professional experience in product delivery, DevOps, or a related engineering field, with an interest in application security, cloud security, or secure development practices.
• Security experience gained through engineering work, including OWASP, CTF participation, open-source security contributions, or hands-on use of SAST/DAST, container security, or SBOM tooling.
• Ability to assess criticality without relying exclusively on a formal framework and communicate findings clearly to technical and non-technical audiences.
• Experience working in an agile environment such as Scrum, Kanban, or OKRs.
• Proficiency in written and spoken English.

Nice to have

• Knowledge of cloud security, preferably GCP or Azure.
• Knowledge of DORA, the EU AI Act, or the Cyber Resilience Act.
• Security certifications such as AWS/GCP Security, OSCP, or equivalent.
• German language skills.

Culture & Benefits

• Work in a newly built unit at the intersection of technology, regulation, and capital markets.
• Collaborate closely with the Group CISO, the Head of ICT Risk, first-line engineering teams, product teams, and supervisory bodies.
• Operate in a second-line risk function overseeing critical financial market infrastructure.