Senior Information Security & GRC Lead

ICEYE; Espoo; Hybrid; EUR 90,000 - 130,000; Full time

Job summary

ICEYE is seeking an Information Security Officer to own and mature the Security Governance, Risk & Compliance program across multiple countries. You’ll drive ISO 27001, NIS2 and CRA compliance, coordinating with governance, legal and engineering teams to ensure audit readiness and practical controls.

You will work in a hybrid model from Espoo, Finland, reporting to the VP Security, with responsibility for cross-jurisdiction frameworks and external audits.

Qualifications

• Proven hands-on ISO 27001 implementation, audits or maintenance in a real org.
• Knowledge of NIS2 obligations and translating them into controls and reporting.
• Familiarity with NIST CSF and 800-53 mappings to ISO 27001/other standards.
• Awareness of the Cyber Resilience Act (CRA) for products with digital elements.
• Experience building or maintaining a risk register and running structured risk assessments.
• Strong stakeholder management to influence engineering, legal and leadership without formal authority.

Responsibilities

• Own and mature ICEYE's ISO 27001 ISMS, including risk assessments, risk register, SoA, audits and surveillance cycles.
• Operationalise NIS2 obligations across ICEYE's entities, turning regulations into policies, controls and evidence.
• Assess CRA and other EU product-security laws against ICEYE's products and close gaps before deadlines.
• Maintain cross-jurisdiction compliance view (NIST, ISO 27001, NIS2, CRA) across Finland, Germany, Spain, Poland, UK, Greece.
• Run third-party/vendor security risk assessments and support client due diligence.
• Produce concise compliance/risk reporting for senior leadership with status against audits/remediation.
• Maintain security policies and documentation; keep them practical and enforceable.
• Serve as day-to-day contact for auditors, certification bodies and regulators on GRC matters.

Skills

ISO 27001

NIS2

NIST CSF

CRA awareness

Risk assessments

Stakeholder mgmt

Multi-country regulation

CISSP/CISM/CRISC

AI governance

Tools

GRC tooling (OneTrust etc.)

ServiceNow GRC

Job description

ICEYE is seeking an Information Security Officer to own and mature the Security Governance, Risk & Compliance program across multiple countries. You’ll drive ISO 27001, NIS2 and CRA compliance, coordinating with governance, legal and engineering teams to ensure audit readiness and practical controls.

You will work in a hybrid model from Espoo, Finland, reporting to the VP Security, with responsibility for cross-jurisdiction frameworks and external audits.