Cybersecurity GRC Manager

Stealth Startup; Lombardia; On-site; EUR 65,000 - 102,000; Full time

Job summary

Stealth Startup is seeking a Cybersecurity GRC Manager to design and run the company’s information security governance, risk and compliance program. You will build our ISMS from scratch, own the certification roadmap, and drive the first certification with close collaboration with the Security Engineer.

You will report to the Director of Software Engineering and, as the company scales, it is a natural path toward CISO leadership. Italian and English fluency are required.

Qualifications

• Bachelor’s degree in CS, Engineering, Info Security, Law or equivalent.
• 7+ years in information security governance, risk and compliance in relevant sectors.
• Hands-on ISO/IEC 27001 certification experience end-to-end.
• Working knowledge of NIS2 and GDPR security requirements.
• Ability to understand cloud/infrastructure architectures well enough to challenge engineers.
• Fluent English and Italian.

Responsibilities

• Define and run the security governance, risk and compliance program (ISMS).
• Own the certification roadmap and lead audits.
• Manage incident notification procedures and regulatory reporting.
• Govern supplier and host-site security requirements in deployment agreements.
• Coordinate cross-functional teams (security, engineering, legal, operations).
• Prepare customers and regulators for due diligence and audits.

Skills

Security governance

Risk management

Compliance

Cloud/infrastructure understanding

Ownership/autonomy

English and Italian fluency

Education

Bachelor’s degree in CS/Engineering/Info Security/Law

Tools

ISO/IEC 27001 Lead Implementer

ISO/IEC 27001 Lead Auditor

CISM/CISSP or equivalent

Job description

About Us

We are an early-stage technology company operating at the intersection of Energy and AI infrastructure, focused on developing a new generation of efficient and scalable computing infrastructure.

Our approach combines distributed computing, modular infrastructure and energy efficiency to support the rapidly growing demand for AI and high-performance computing.

The company is developing a new model for deploying compute capacity in a flexible and scalable way, with a strong focus on efficiency, sustainability, reliability and responsible infrastructure development.

This is an opportunity to join a growing team at an early stage and contribute directly to the development of a new infrastructure platform, working at the intersection of power, data centers and advanced computing.

Position Type

Part of the Security function, initially reporting to the Director of Software Engineering, then directly to the CEO ahead of our first certification audit, to ensure the independence of the compliance function.

Role Overview

We are seeking a Cybersecurity GRC Manager to build and run the security governance, risk and compliance of the company. Our self-contained, outdoor-deployable compute units form sovereign, multi-tenant GPU clusters operating under European and Italian regulation. You will build our information security management system from scratch, own the certification roadmap for our markets, and take the company through its first certification. You will work alongside the Security Engineer, who owns the technical controls. This role is the natural path to a CISO position as the company scales.

What You Will Deliver

This is a high-impact, high-ownership role: you will define how we prove to customers, auditors and regulators that our infrastructure is secure.

Within 6 months: You will deliver the foundations of our security programme: a gap analysis against ISO/IEC 27001 and NIS2, a clear position on our NIS2 obligations in Italy, the ISMS scope, core policies and risk register, an incident notification procedure, and a certification roadmap agreed with the CEO, based on our target customers and markets.

Within 12 months: You will run an operating ISMS ready for a first certification audit, with supplier and host-site security requirements in place, and you will have started the certification or qualification chosen for our priority market.

Key Responsibilities

• Build and run the information security management system: policies, risk management, statement of applicability and continuous improvement.


• Define how the company organizes for security: roles and responsibilities (RACI) and the interfaces between security, engineering, operations and legal; set the security requirements and deadlines the engineering teams commit to.


• Own the certification roadmap: decide which certifications and qualifications to pursue, when and why, and lead their implementation.


• Own security regulatory compliance (NIS2, GDPR security obligations) and define the open-source licence policy together with Legal.


• Own audit readiness: plan audits, collect evidence from engineering teams and track remediation.


• Own the incident management process: classification, regulatory notification, customer communication and post-incident review, with the Security Engineer handling the technical response.


• Run third-party and supply-chain security (suppliers, hardware vendors, security clauses in contracts), and define security requirements for host sites in our deployment agreements, together with the Security Engineer and Operations.


• Answer customer security due diligence, run security awareness and report the security posture to management.

Requirements

• Bachelor’s degree in Computer Science, Engineering, Information Security, Law or equivalent field


• 7+ years of experience in information security governance, risk and compliance, in a cloud provider, data center operator, telecom operator, technology company or consultancy


• Hands-on experience taking an organization through ISO/IEC 27001 certification, at least once end to end


• Working knowledge of NIS2 and of GDPR security requirements


• Ability to understand cloud and infrastructure architectures well enough to challenge engineers


• Ability to work in a fast-paced, early-stage environment with a high degree of ownership and autonomy


• Fluent English and Italian

Nice to Have

• ISO/IEC 27001 Lead Implementer or Lead Auditor, CISM, CISSP or equivalent certification


• Experience with a cloud certification or qualification scheme (e.g. ACN qualification, SecNumCloud, BSI C5)


• Experience with business continuity management (e.g. ISO 22301)


• Prior experience at a startup or scale-up, building a compliance programme from scratch.

Salary Expectation

RAL 65.000€ – 102.000€ + equity (The compensation package will be determined based on the candidate’s seniority, experience and level of expertise.)

Location

Milan, Italy.