ISO 27001 Implementation Lead Exp in Tisax

Scope and plan. Confirm and control the scope and implementation plan, building on the existing action plan. Define

workstream ownership, priorities, milestones, dependencies, acceptance criteria, evidence requirements, decision points,

and reporting cadence through readiness and certification audits.


Assessment. Validate ISO 27001 clauses and applicable Annex A controls against the existing TISAX assessment and

evidence. Maintain one prioritized gap, risk, and remediation plan with accountable owners, due dates, closure criteria,

and verification evidence.


ISMS design. Validate and operationalize the existing risk assessment and treatment method, complete the risk register and. Statement of Applicability, confirm policy and control ownership, reconcile document status, and establish a controlled

evidence repository. Existing documents should be reviewed and improved rather than recreated by default.


Control delivery. Coordinate implementation across infrastructure, cybersecurity, ERP and plant systems, identity,

vendors, physical protection, mobile IT, projects, and business processes without displacing operational control owners.


Prioritize asset and CMDB ownership, access governance, physical protection, third-party security, and repeatable

evidence.


Assurance. Prepare ISO 27001 awareness activities, internal audit, management review, corrective actions, and evidence
of control operation. Integrate with existing ITGC, SOX, IATF, TISAX, penetration-test, resilience, and other applicable
evidence, and verify that findings are tracked through closure and retest.


Certification. Coordinate certification-body selection, readiness reviews, and Stage 1 and Stage 2 audits. Maintain the

assessor request log, prepare control owners for interviews, track findings, and drive corrective-action closure and

verification with accountable owners and the certification body.



Leadership - Has led cross-functional security or compliance programs across multiple sites, with clear ownership,


practical prioritization and executive reporting.



ISO 27001 practice


Experience operationalizing an existing ISO 27001 ISMS foundation through audit

readiness, including gap validation, risk treatment, Statement of Applicability, control

implementation, evidence repositories, internal audit, management review, corrective action,

and Stage 1 and Stage 2 support.



Business partnership


Can work with manufacturing plants, Facilities, HR/Privacy, Legal, Procurement, corporate

functions, IT teams, stakeholders, consultants, operational control owners, and

certification bodies while preserving internal accountability.





Experience with manufacturing or operational technology boundaries, ERP and plant

systems, ITGC, ServiceNow CMDB, identity and access governance, supplier security,

physical protection, mobile IT, privacy/PII integration, and existing quality management

systems.