Information Security GRC Specialist

Generative Bionics S.r.l.; Genova; Hybrid; EUR 60,000 - 90,000; Full time

Job summary

Generative Bionics is seeking an Information Security GRC Specialist to strengthen governance, risk management, and compliance across the company’s products and operations in Genova. You will translate regulations into practical security requirements and support audits, certifications, and incident governance.

Collaborating with engineering, legal, and business teams, you will track remediation, define KPIs, and promote secure development practices, privacy by design, and supplier risk

Qualifications

• Bachelor's or Master's degree or equivalent professional experience.
• At least 3 years of information security governance, risk management, or compliance experience.
• Solid understanding of information security governance frameworks such as ISO/IEC 27001, NIST CSF, CIS Controls.

Responsibilities

• Develop and maintain information security governance framework, risk assessment, policies, standards, and controls.
• Support regulatory compliance with EU and global frameworks (GDPR, EU Cyber Resilience Act, NIS2, etc.).
• Translate regulatory requirements into pragmatic security requirements for products and processes.
• Track remediation plans and monitor residual risk across business and IT environments.
• Define and monitor security KPIs/KRIs and prepare management reporting.
• Assist audits, certifications, and evidence collection; ensure timely remediation of findings.
• Advise teams on security requirements and integrate controls into projects and products.
• Support third‑party security governance and supplier risk management.
• Promote secure development practices and security-by-design across the product lifecycle.
• Contribute to incident governance and post‑incident reviews.
• Foster a security‑aware culture through training and communications.

Skills

Information security governance

Risk management

Regulatory compliance

Audit support

Stakeholder management

English proficiency

Communication skills

Education

Bachelor's or master's degree

Tools

ISO 27001

NIST CSF

CIS Controls

IEC 62443

Job description

About Us

Generative Bionics is a deep-tech company building humanoid robot platforms to deploy human-centered Physical AI. We design intelligent, capable machines that work alongside people in real-world environments — developed in Genova, Italy.

Role

We are looking for an Information Security GRC Specialist to strengthen our information security governance program and support the secure growth of our business, products, and technology ecosystem.The role will contribute to the development of a scalable governance framework covering corporate information security, product cybersecurity, regulatory compliance, risk management, and security-by-design principles across the organization.Working closely with engineering, technology, legal, operations, and business teams, the successful candidate will help ensure that security, privacy, resilience, and regulatory requirements are consistently integrated into company processes, products, and strategic initiatives.

Responsibilities

• - Develop, maintain, and continuously improve the organization’s information security governance framework, risk assessment, processes, policies, standards, procedures, and control requirements;
• - Maintain knowledge of and support compliance with key regulations, standards, and frameworks applicable to a humanoid robotics manufacturer, including the EU Cyber Resilience Act, GDPR, EU AI Act, NIS2 Directive, EU Machinery Regulation, EU Data Act, ISO/IEC 27001, NIST Cybersecurity Framework, CIS Controls, IEC 62443, and other applicable product safety, connected-product, industrial cybersecurity, privacy, and supply-chain requirements;
• - Translate regulation requirements into practical organizational, technical, and product security requirements;
• - Track remediation plans, and monitor residual risk across business processes, IT environments, cloud services, products, and third parties;
• - Define and monitor security performance and risk indicators (KPI, KRI), prepare management reporting, and escal ... material issues to relevant governance forums;
• - Support internal and external audits, security assessments, certification activities, and evidence collection, ensuring timely remediation of findings;
• - Advise business, technology, engineering, and operational teams on security requirements and support the integration of appropriate controls into projects, products, and processes;
• - Support third-party security governance, including contractual security requirements, risk monitoring, and remediation follow-up;
• - Support product cybersecurity governance activities by collaborating with engineering teams to ensure security-by-design principles, cybersecurity requirements, vulnerability management processes, and regulatory product security obligations are effectively implemented throughout the product lifecycle;
• - Contribute to incident governance by supporting escalation, post-incident reviews, lessons learned, and the tracking of corrective actions;
• - Promote a strong security culture through awareness programs, targeted communications, training initiatives, and stakeholder engagement activities;

Requirements

• - Bachelor’s or master’s degree in a scientific or humanities discipline, or equivalent professional experience;
• - At least 3 years of experience in information security governance, risk management, compliance, internal audit, or comparable cybersecurity functions;
• - Sound understanding of information security, cybersecurity governance, risk management, and control frameworks such as ISO/IEC 27001, NIST Cybersecurity Framework, CIS Controls, or equivalent standards;
• - Ability to assess security risks, evaluate control effectiveness, identify gaps, and translate findings into pragmatic, risk-based recommendations;
• - Ability to understand, interpret, and operationalize cybersecurity, privacy, resilience, and product security regulations into practical governance processes and controls;
• - Practical experience in developing and maintaining security policies, standards, procedures, risk registers, control frameworks, and remediation plans;
• - Experience supporting audits, certifications, regulatory assessments, and evidence collection activities;
• - Strong analytical, organizational, and documentation skills, with attention to detail and the ability to manage multiple priorities;
• - Excellent communication and stakeholder management skills, with the ability to explain security requirements clearly to both technical and non-technical audiences;
• - Ability to work effectively across business, technology, engineering, legal, compliance, and operational teams- Professional proficiency in English;
• - High standards of integrity, accountability, confidentiality, and professional judgment;
• - Availability to travel nationally and internationally is expected;

• - Experience supporting ISO/IEC 27001 implementation and certification projects;
• - Experience in manufacturing, industrial automation, automotive, aerospace, IoT, embedded systems, or critical infrastructure environments;
• - Familiarity with Secure Development Lifecycle (SDLC), vulnerability management, and product cybersecurity programs;
• - Knowledge of cloud governance and modern identity and access management concepts;
• - Exposure to supplier security assessments and third-party risk management programs;
• - Professional certifications such as ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, or equivalent;

We Offer

• - The opportunity to help build one of Europe's most ambitious humanoid robotics companies;
• - Work on cutting-edge technologies at the intersection of AI, robotics, software, electronics, and manufacturing;
• - A collaborative, multidisciplinary, and fast-paced, high-growth innovation-driven environment;
• - Direct exposure to strategic programs with tangible impact on product development and company growth;
• - Concrete opportunities for professional development and career advancement;
• - Competitive compensation aligned with experience;

Disclaimer

We are proud to be an Equal Opportunity Employer. We evaluate all qualified applicants solely on the basis of merit and business needs, without distinction or discrimination based on gender, race, color, ethnic or social origin, age, religion, sexual orientation, gender identity, disability, or any other characteristic protected by law.