Engineering Manager, GRC & Assurance — ISO 27001 Lead

Vinted; Amsterdam; Hybrid; EUR 100,000 - 132,000; Full time

Benefits offered by this job

Share options

Paid annual leave

MacBook laptop

Mental health support

Team events

Home office budget

Lunch allowance

Gym subsidy

Pension plan

Shopping budget

Mobility card

Workation

Dog-friendly office

Job summary

Vinted is seeking an Engineering Manager to lead GRC and Assurance in Group Security. You will own risk management, compliance and audit liaison, AI governance, third‑party risk and business continuity across Marketplace, Vinted Go and Vinted Payments in a dynamic regulatory environment.

We want a practitioner who turns requirements into real controls, mentors the team and grows talent through hands‑on leadership.

Qualifications

• You have run a security governance or compliance function through a certification or a regulator's examination, ISO 27001 or something comparable.
• You think like an engineer about governance: you can say how a control can be automated and how evidence gets collected without a spreadsheet.
• You can hold several regimes in your head at once and tell a real obligation from an assumed one.
• You develop specialists rather than delivering around them, and you will say something is not compliant when nobody wants to hear it.

Responsibilities

• Deliver ISO 27001 by 2027: Own the scope, audits, and a single control set covering NIS2 and DORA (with PCI DSS managed separately).
• Map our compliance stack: Build the master map across all three businesses (what applies, when, and liability) to unblock key decisions.
• Run governance like engineering: Turn controls into code, automate evidence, and serve as the first user for Group Security’s new posture platform.
• Lead and grow the team: Manage seven functions, develop specialists on Lead Implementer/Auditor tracks, and add three new hires through early 2027.

Job description

Vinted is seeking an Engineering Manager to lead GRC and Assurance in Group Security. You will own risk management, compliance and audit liaison, AI governance, third‑party risk and business continuity across Marketplace, Vinted Go and Vinted Payments in a dynamic regulatory environment.

We want a practitioner who turns requirements into real controls, mentors the team and grows talent through hands‑on leadership.