EU/UK GRC Engineer: Data Protection & Compliance

AI Chopping Block; Greater London; Hybrid; GBP 80,000 - 110,000; Full time

Job summary

SpaceXAI is seeking an experienced GRC Engineer to scale information security and regulatory compliance across EU/UK markets. You will architect and automate trust through policy-as-code and continuous evidence collection, partnering with engineering to embed controls early in design.

The role requires hands-on experience with DORA, EU AI Act, NIS2, and related obligations, plus strong collaboration with auditors and the privacy team. Occasional travel may be required.

Qualifications

• Bachelor's degree in computer science, information security, or a related STEM field.
• 5+ years in GRC, information security compliance, or technology audit roles in fintech, banking, payments, or other regulated environments with EU/UK exposure.
• Hands-on experience implementing controls across DORA, EU AI Act, NIS2, PSD2/PSR, or UK PRA/FCA operational resilience expectations.
• Familiar with EU/UK data privacy regulations (GDPR) and liaising with Privacy counterparts.

Responsibilities

• Own and evolve EU/UK regulatory posture across DORA and related guidance for xMoney.
• Build and maintain Compliance-as-Code capabilities and automated control validation integrated into CI/CD.
• Operate GRC platforms (e.g., Vanta) and integrate with cloud, identity, logging, and engineering systems.
• Partner with Architects and Engineering Leads to bake EU/UK security and regulatory requirements into design early.

Skills

GRC engineering

Compliance checks integration

CI/CD integration

Security risk assessment

Communication with engineers

Education

Bachelor's degree in CS / Info Security / Cybersecurity / STEM

Tools

Vanta

Job description

SpaceXAI is seeking an experienced GRC Engineer to scale information security and regulatory compliance across EU/UK markets. You will architect and automate trust through policy-as-code and continuous evidence collection, partnering with engineering to embed controls early in design.

The role requires hands-on experience with DORA, EU AI Act, NIS2, and related obligations, plus strong collaboration with auditors and the privacy team. Occasional travel may be required.