IT & Cybersecurity Manager

Geographic scope: Spain
Reports to: Digital Innovation Lead
Starting date: ASAP
Employment type: Full-time, permanent
Location: Remote, with an expectation of travel up to 30 days per year
Salary range: 40,000 – 45,000€ anually (depending on experience)
About Patvocates
Patvocates is a Germany-based, patient-driven, not-only-for-profit consultancy, acting in the triangle of patient advocacy, health policy and medicines research and development. We are a remote-first, cloud-based organisation of approximately 40 employees plus contractors, operating across multiple countries. We handle sensitive health and personal data and must meet the increasingly rigorous cybersecurity and vendor assurance requirements of pharmaceutical clients.
The role
As our first dedicated IT & Cybersecurity Manager, you will be the day-to-day owner of operational IT, cybersecurity and user support across the organisation. You will help ensure our people, devices, systems and data remain secure while enabling the business to scale. Working as part of the Digital Unit, you will serve as the primary internal point of contact for IT and security matters, coordinate with external specialist partners, and help mature our Information Security Management System (ISMS) to meet client and regulatory expectations. This is a hands-on role combining day-to-day IT operations, end-user support, cybersecurity and information security governance.
Key responsibilities1. Operational IT & End-User Support
· Act as the primary point of contact for IT questions, incidents and service requests across the organisation.
· Manage user lifecycle processes including onboarding, role changes, access reviews and offboarding.
· Administer and maintain the Microsoft 365 ecosystem and SaaS tools.
· Support and manage company-owned devices, including Windows and Apple/macOS endpoints.
· Monitor system health, device compliance, mailbox administration and identity management.
· Coordinate hardware procurement, configuration, asset tracking and secure disposal.
· Develop user guides, onboarding content and practical security guidance.
2. Cybersecurity Operations & Compliance
· Monitor cybersecurity posture, investigate alerts, and coordinate response activities for security events and incidents.
· Maintain security controls including MFA, identity and access management, endpoint protection, encryption and secure configuration baselines.
· Perform regular access reviews, vulnerability management activities and risk assessments.
· Support implementation and continuous improvement of security policies and procedures.
· Coordinate third-party security reviews, supplier assessments and client security questionnaires.
· Promote security awareness and deliver practical training and guidance to colleagues.
· Act as the internal owner for security governance activities and evidence collection.
3. ISMS, ISO 27001 & Governance
· Coordinate the ongoing development and maintenance of the Information Security Management System (ISMS).
· Drive ISO 27001 readiness activities in collaboration with external cybersecurity consultants and specialist partners.
· Support compliance initiatives related to GDPR, NIS2 and customer security requirements.
· Maintain risk registers, security documentation, policies, procedures and audit evidence.
· Help prepare internal reviews, external assessments and pharma-client vendor due diligence exercises.
4. Digital Unit & Business Enablement
· Provide security and architecture input to internal digital solutions and client-facing technology projects.
· Review new software, AI tools and technology vendors from security, privacy and operational perspectives.
· Advise leadership on cybersecurity risks, priorities and investment decisions.
· Help establish pragmatic processes that balance security, compliance and business agility.
· Required Skills & Experience 4+ years of experience in IT administration, IT operations or technical support.
· Demonstrated cybersecurity responsibility in a business environment.
· Strong knowledge of Microsoft 365, Entra ID, device management, SaaS administration and cloud-based environments.
· Practical understanding of ISO 27001, GDPR, NIS2 and information security best practices.
· Experience managing endpoints, identities, access controls and security incidents.
· Ability to communicate effectively with non-technical colleagues.
· Fluent English; Spanish and/or German is an advantage.
Nice to Have
· Experience supporting a remote-first organisation.
· Experience in healthcare, life sciences, patient engagement or regulated industries.
· Familiarity with AI governance and secure AI adoption.
· Relevant certifications such as CISSP, CISM, Security+, ISO 27001 Lead Implementer/Auditor or equivalent.
How to apply
· Please send your CV and a short cover letter (in English) via this link.
Data Protection Notice
Patvocates GmbH, Am Rothenanger 1b, 85521 Riemerling (Germany), is the controller of the personal data you submit through our application form: your name, CV and cover letter.
Purpose and legal basis: we use your data only to assess your application for the position you have applied for. This is necessary to take steps at your request before possibly entering an employment contract (Art. 6(1)(b) GDPR). No decisions about your application are made solely by automated means.
Please do not include photos, date of birth or any other personal data that is not relevant to the role. You do not need to share health information. If you choose to mention lived experience of illness or disability, we will use it only for this application process.
Who can see your data: only the people involved in the recruitment process. We use ClickUp as our service provider to receive and manage applications. As ClickUp is based in the United States, your data may be transferred outside the EEA. Such transfers are covered by the EU-US Data Privacy Framework and/or Standard Contractual Clauses.
How long we keep it: we delete your application within 6 months after the recruitment process closes. If you are hired, your application will become part of your personnel file.
Your rights: you can ask for access to your data, or for its rectification, erasure, restriction, objection or portability, by contacting us at mailto:legal@patvocates.net or our Data Protection Officer, DataGuard (DataCo GmbH), at mailto:dpo@dataguard.de. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State where you live or work, or with the authority competent for Patvocates GmbH, the Bavarian Data Protection Authority (BayLDA, ).

Work arrangement
Yes