Overseas Data Security & Governance Engineer

XPENG; München; Vor Ort; EUR 120.000 - 150.000; Vollzeit

Benefits dieser Stelle

Pension plan

Bonus potential

Growth at EV brand Europe

Zusammenfassung

XPENG is seeking a senior data security and regulatory compliance lead to manage the full lifecycle of data security and privacy across Europe. You will roll out the Group's data security strategy, data classification and access-control policies, and operate the European governance framework.

Lead regulatory compliance for GDPR, NIS2, DPIA/PIA, and cross-border data transfers, and drive audits and engagements with DPAs and regulators across Europe.

Qualifikationen

• Bachelor's degree or higher in CS, information security or law.
• 5+ years in data security or cybersecurity.
• Experience in GDPR, NIS2, DPIA/PIA, data classification.
• Experience with ISO/IEC 27001/27701 audits.

Aufgaben

• Oversee EU data security governance across Europe.
• Lead GDPR, NIS2, DPIA and cross-border data transfer initiatives.
• Manage external audit readiness and responses.
• Coordinate with HQ Security, Legal, and Compliance on new European deployments.

Kenntnisse

Data security

Regulatory compliance

Audits & DPIA

Cross-functional coordination

Regulatory engagement

Ausbildung

Bachelor's degree

Tools

ISO/IEC 27001

ISO/IEC 27701

Jobbeschreibung

1. Data Security Governance in Europe – Manage the full lifecycle of data security and privacy compliance across the European region; lead the rollout of the Group's data security strategy, data classification & grading, and access control policies; help build and operate the European data security governance framework and operating mechanisms.
2. European Regulatory Compliance – Track regulatory developments in EU data security and cybersecurity, including GDPR, NIS2 (with Germany's NIS2UmsuCG and the Netherlands' Cbw), the EU AI Act, the Cyber Resilience Act (CRA), and the Data Act. Lead the implementation of compliance requirements such as DPIA and cross-border data transfer assessments. Build and operate dual incident notification mechanisms covering both the GDPR 72-hour and NIS2 24/72-hour timelines.
3. External Audit & Regulatory Engagement – Lead external audit preparation for European security systems (e.g., ISO/IEC 27001, ISO/IEC 27701); maintain audit evidence chains, SOPs, and drill records. Act as the security-side point of contact for Data Protection Authorities (DPAs) and other regulators, responding to inquiries, inspections, and security incident notifications.
4. HQ–Region Collaboration & New Business Security Review – As the European data security interface, collaborate with HQ Security Operations, Data Compliance, and Legal teams to support security review and risk closure for new business rollouts in Europe, such as energy storage & charging stations and smart charging.

Qualifications:

1. Bachelor's degree or above in Computer Science, Information Security, Law, or a related field; 5+ years of experience in data security / cybersecurity; experience across both in-house and consulting/vendor environments is preferred.
2. Solid knowledge of the European data compliance regulatory landscape, with hands‑on experience in GDPR, NIS2, cross‑border data transfer, DPIA/PIA, and data classification & grading.
3. Familiar with the ISO/IEC 27001 and ISO/IEC 27701 management system frameworks; hands‑on experience in external audit preparation or audit response.
4. Solid data security technical background (access control, encryption, data masking, monitoring & auditing, etc.) with the ability to drive technical controls into the European region.
5. Strong cross‑functional and cross‑cultural communication and coordination skills; able to independently engage with regulators, external law firms, and audit bodies.
6. English as a working language; German language skills are a plus. Able to be based in Europe on a long‑term basis or to take short‑term overseas assignments.

Nice to Have

1. CISSP, CIPP/E, CISM, ISO/IEC 27001 Lead Auditor, or equivalent certifications.
2. Background in automotive, manufacturing, or the energy industry; familiar with UN R155 / CSMS or other automotive cybersecurity regulations; experience in EV charging or energy storage.
3. Prior engagement with regulators such as Germany's BSI, the Netherlands' NCSC, or European DPAs.

XPENG offers:

• An interesting, unique and very varied job at XPENG
• A job with an incredibly large contact surface both internally and externally
• An attractive salary package incl. pension and with the possibility of a bonus
• To be involved in the growth of an existing EV brand in Europe

Our Commitment to Diversity and Inclusion:

At XPENG, we’re an equal‑opportunity employer that values diversity and positively encourages applications from suitably qualified and eligible candidates regardless of race, religion, sex, national origin, gender, sexual orientation, age, marital status, disability status or other applicable legally protected characteristics.