Open position
GRC Engineer (m/f/d) – NIS2, DORA, CRA, ISO 27001 & ISO 42001
Hybrid: mostly remote within Germany, occasionally at our Bonn office.
You turn regulation into machine-readable controls and automated GRC processes – with VamiGRC, for clients in critical infrastructure, finance and industry.
Your responsibilities
- Build and evolve integrated management systems (ISMS to ISO 27001, AIMS to ISO 42001) – from scope and Statement of Applicability to certification readiness
- Implement regulatory requirements from NIS2, DORA, the CRA and the EU AI Act, including gap analyses and remediation plans
- Model controls, cross-mappings and frameworks in VamiGRC (OSCAL) and automate evidence and workflows with AI agents
- Quantitative risk management, supplier assessments (TPRM) and preparation of internal and external audits
- Work closely with the product team: requirements from client projects flow straight into the platform
Your profile
- Several years of experience in GRC, ISMS or IT compliance, ideally in regulated industries
- In-depth knowledge of ISO 27001 and at least two of NIS2, DORA, CRA, ISO 42001 or the EU AI Act
- Technical understanding (cloud, IAM, vulnerability management) and a passion for automation, e.g. with Python, APIs or OSCAL
- Excellent German (at least C1) and good English
- A plus: ISO 27001 or ISO 42001 Lead Auditor, CISA, CISM or BSI IT-Grundschutz Practitioner
ISO 27001ISO 42001NIS2DORACRAEU AI ActOSCAL
What We Offer
Why VamiSec?
Remote-First
Flexible work from anywhere in Germany – we trust in results.
Professional Development
Certifications, training, and conferences – we invest in your growth.
Responsibility
Autonomous work on exciting projects for renowned clients.
Team
Small, highly motivated team with flat hierarchies and direct communication.
Fair Compensation
Competitive salaries, bonuses, and benefits – transparent and performance-based.
Impact
Your work makes organizations and critical infrastructure more secure.