Working Student Trust (third-party Risk Management)

Celonis Celonis · Data AI · Munich, Germany · Information Security

This role supports the Security Risk Management team in evaluating the risk profiles of third-party vendors to ensure they meet Celonis' security standards. It involves performing security evaluations, monitoring vendor risk, administering GRC platforms, maintaining data integrity, and creating security documentation. The role requires a student in a relevant field with a basic understanding of security frameworks and an interest in cloud security.

What you'd actually do

  1. Assist in performing security evaluations of new and existing vendors to ensure they meet Celonis’ security requirements.
  2. Monitor the ongoing security posture of our third-party ecosystem for deficiencies and track remediation efforts.
  3. Support the day-to-day management and configuration of our Governance, Risk, and Compliance (GRC) platform to streamline risk workflows.
  4. Maintain high-quality data within our risk registers and vendor databases, ensuring all records are accurate, up-to-date, and audit-ready.
  5. Help create and maintain internal records related to vendor audits and compliance checks (e.g., SOC2, ISO 27001).

Skills

Required

  • Currently enrolled in a Bachelor’s or Master’s program in Information Security, Business Informatics, or a related field.
  • Basic understanding of security and regulatory frameworks (e.g., ISO 27001, GDPR, or SOC 2).
  • An exceptional eye for detail and a value for correctness and efficiency.
  • Excellent problem-solving skills and the ability to communicate effectively in English.
  • A proactive mindset and the desire to work in a fast-paced, high-growth environment.
  • Must be currently based in or around Munich, Germany, and able to work on-site at our headquarters

Nice to have

  • A keen interest in how cloud-native environments (AWS, Azure, or GCP) manage security and compliance.
  • Experience with GRC tools or a passion for using automation to improve repeatable processes.

What the JD emphasized

  • security standards
  • security requirements
  • security posture
  • security goals
  • security documentation
  • security standards
  • security and regulatory frameworks
  • security and compliance