GRC Engineer (m/f/d) – NIS2, DORA, CRA, ISO 27001 & ISO 42001

VamiSec GmbH; Bonn; Hybrid; EUR 80,000 - 110,000; Full time

Benefits offered by this job

Flexible work options

Bonuses

Job summary

VamiSec GmbH in Germany seeks an experienced GRC/ISMS expert to shape and govern our GRC platform, VamiGRC, across ISO 27001 and regulatory requirements. You will drive risk assessment, evidence automation, and audits while collaborating with product teams to translate client needs into the platform.

Hybrid role: mostly remote within Germany, with occasional time at our Bonn office. Fluency in German (C1) and English is essential, plus hands-on automation and OSCAL experience.

Qualifications

• Several years of experience in GRC, ISMS or IT compliance, ideally in regulated industries.
• In-depth knowledge of ISO 27001 and at least two of NIS2, DORA, CRA, ISO 42001 or the EU AI Act.
• Technical understanding (cloud, IAM, vulnerability management) and a passion for automation, e.g. with Python, APIs or OSCAL.
• Excellent German (at least C1) and good English.

Responsibilities

• Build and evolve integrated management systems (ISMS to ISO 27001, AIMS to ISO 42001) – from scope and Statement of Applicability to certification readiness.
• Implement regulatory requirements from NIS2, DORA, the CRA and the EU AI Act, including gap analyses and remediation plans.
• Model controls, cross-mappings and frameworks in VamiGRC (OSCAL) and automate evidence and workflows with AI agents.
• Quantitative risk management, supplier assessments (TPRM) and preparation of internal and external audits.
• Work closely with the product team: requirements from client projects flow straight into the platform.

Skills

GRC/ISMS experience

ISO27001 knowledge

NIS2/DORA/AI Act knowledge

Automation with Python

Cloud/IAM expertise

German (C1) & English

Tools

Python

APIs

OSCAL

Job description

Hybrid: mostly remote within Germany, occasionally at our Bonn office.

You turn regulation into machine-readable controls and automated GRC processes – with VamiGRC, for clients in critical infrastructure, finance and industry.

Your responsibilities

• Build and evolve integrated management systems (ISMS to ISO 27001, AIMS to ISO 42001) – from scope and Statement of Applicability to certification readiness
• Implement regulatory requirements from NIS2, DORA, the CRA and the EU AI Act, including gap analyses and remediation plans
• Model controls, cross-mappings and frameworks in VamiGRC (OSCAL) and automate evidence and workflows with AI agents
• Quantitative risk management, supplier assessments (TPRM) and preparation of internal and external audits
• Work closely with the product team: requirements from client projects flow straight into the platform

Your profile

• Several years of experience in GRC, ISMS or IT compliance, ideally in regulated industries
• In-depth knowledge of ISO 27001 and at least two of NIS2, DORA, CRA, ISO 42001 or the EU AI Act
• Technical understanding (cloud, IAM, vulnerability management) and a passion for automation, e.g. with Python, APIs or OSCAL
• Excellent German (at least C1) and good English

ISO 27001 ISO 42001 NIS2 DORA CRA EU AI Act OSCAL

Your responsibilities

• Build and evolve integrated management systems (ISMS to ISO 27001, AIMS to ISO 42001) – from scope and Statement of Applicability to certification readiness
• Implement regulatory requirements from NIS2, DORA, the CRA and the EU AI Act, including gap analyses and remediation plans
• Model controls, cross-mappings and frameworks in VamiGRC (OSCAL) and automate evidence and workflows with AI agents
• Quantitative risk management, supplier assessments (TPRM) and preparation of internal and external audits
• Work closely with the product team: requirements from client projects flow straight into the platform

Your profile

• Several years of experience in GRC, ISMS or IT compliance, ideally in regulated industries
• In-depth knowledge of ISO 27001 and at least two of NIS2, DORA, CRA, ISO 42001 or the EU AI Act
• Technical understanding (cloud, IAM, vulnerability management) and a passion for automation, e.g. with Python, APIs or OSCAL
• Excellent German (at least C1) and good English
• A plus: ISO 27001 or ISO 42001 Lead Auditor, CISA, CISM or BSI IT-Grundschutz Practitioner

ISO 27001 ISO 42001 NIS2 DORA CRA EU AI Act OSCAL

Your contact Valeri Milke Founder & CEO, VamiSec

[e-mail] LinkedIn

Flexible work from anywhere in Germany – we trust in results.

Professional Development

Certifications, training, and conferences – we invest in your growth.

Responsibility

Autonomous work on exciting projects for renowned clients.

Team

Small, highly motivated team with flat hierarchies and direct communication.

Competitive salaries, bonuses, and benefits – transparent and performance-based.

Impact

Your work makes organizations and critical infrastructure more secure.