Engineering Manager, GRC and Assurance

Vinted; Oslo; Hybrid; NOK 1,083,000 - 1,425,000; Full time

Benefits offered by this job

Share options

25 days paid annual leave

Newest MacBook models

EAP and mental health support

Frequent team-building events

Home office budget up to €540

Daily lunch allowance

Pension plan 12% total contrib.

NS mobility card

Workation up to 90 days/year

Dog-friendly office

Job summary

Vinted is seeking an Engineering Manager to lead GRC and Assurance in Group Security, guiding a seven-person team responsible for risk management, compliance and audit liaison, second-line security assurance, AI governance, third-party risk, business continuity and security culture.

You will turn requirements into automated controls, drive ISO 27001 readiness by 2027, map the compliance stack across all three Vinted entities, and mentor security professionals while maintaining hands-on execution.

Qualifications

• Experience running security governance or compliance functions through certification or regulator examinations (ISO 27001).
• Ability to engineer governance: automate controls and evidence collection without spreadsheets.
• Ability to manage multiple regimes and distinguish real obligations from assumptions.
• Experience developing specialists rather than delivering around them.

Responsibilities

• Deliver ISO 27001 by 2027: own scope, audits, and a single control set covering NIS2 and DORA.
• Map the compliance stack across all three Vinted businesses to unblock decisions.
• Run governance like engineering: turn controls into code, automate evidence collection, act as early user for posture platform.
• Lead and grow the team: manage seven functions and hire through early 2027.

Skills

Security governance

Compliance management

ISO 27001 experience

Automation mindset

People development

Education

ISO 27001 certification or equivalent

Job description

Brief info about Vinted

Our mission is to make second-hand the first choice, and we're looking for people who want to help us get there. Every day, we work together to help our members buy and sell pre-loved clothing and lifestyle items, giving each piece a second life – or even a third.
The Vinted Group is made up of three business units that support this mission:
Vinted Marketplace is Europe’s leading platform for second‑hand fashion and a go‑to destination for all kinds of pre-loved items, with a growing range of categories. Our platform connects millions of members across 20+ markets, helping great items find a new life.
Vinted Go enhances the shipping experience with a vast network of over 500,000 pick‑up and drop‑off points, partnering with more than 60 carriers across Europe, with added services like item verification for peace of mind on high‑value pieces.
Vinted Pay is the newest part of the Vinted Group, dedicated to bringing secure, reliable payments to buyers and sellers across Europe. Seamlessly integrated into the Vinted app, it helps keep every transaction safe, efficient, and easy for our members.
Founded in 2008 in Lithuania, Vinted began as a way for friends to find new homes for clothes they no longer needed. In 2019, we became Lithuania's first unicorn! Today, our headquarters remain in Vilnius, and we've grown with offices across Europe, supported by a team of over 2,000 people.

Information about the position

We are looking for an Engineering Manager to lead GRC and Assurance in Group Security: a team of seven today, growing even more in 2027. The team owns risk management, compliance and audit liaison, second‑line security assurance, AI governance, third‑party risk, business continuity and security culture.

Vinted spans three distinct entities: Marketplace, Vinted Go, and Vinted Payments, our regulated payments institution. That means handling a fast‑moving regulatory landscape covering core privacy (GDPR, CCPA), payment licenses, incoming mandates like DORA, NIS2, and the EU AI Act, alongside driving our 2027 ISO 27001 certification. In most companies, governance runs quietly in the background. At Vinted, it’s core architecture.

We are looking for a practitioner rather than a documenter: someone who leads from the front, turns requirements into controls that work, and grows the people around them through hands‑on work.

In this position, you’ll

• Deliver ISO 27001 by 2027: Own the scope, audits, and a single control set covering NIS2 and DORA (with PCI DSS managed separately).
• Map our compliance stack: Build the master map across all three businesses (what applies, when, and liability) to unblock key decisions.
• Run governance like engineering: Turn controls into code, automate evidence, and serve as the first user for Group Security’s new posture platform.
• Lead and grow the team: Manage seven functions, develop specialists on Lead Implementer/Auditor tracks, and add three new hires through early 2027.

About you

• You have run a security governance or compliance function through a certification or a regulator's examination, ISO 27001 or something comparable.
• You think like an engineer about governance: you can say how a control can be automated and how evidence gets collected without a spreadsheet.
• You can hold several regimes in your head at once and tell a real obligation from an assumed one.
• You develop specialists rather than delivering around them, and you will say something is not compliant when nobody wants to hear it.

If you're excited about this role but don't identify with every point above, apply anyway. You might still be the right match.

Work perks

• The opportunity to benefit from our share options programme
• 25 days of paid annual leave
• Newest MacBook models
• Digital mental and emotional health support and Employee Assistant Program (EAP)
• Frequent team‑building events
• Home office support: we provide IT workstation equipment and a personal budget of up to €540 for home workplace furniture
• A daily lunch allowance
• ClassPass (Gym Membership subsidy)
• Pension plan with total contribution of 12%, 8% by the Company and 4% by employee
• A personal monthly budget for shopping on Vinted
• An NS mobility card
• The opportunity to spend up to 90 days per year - 21 of which can be spent working outside of the EU - on workation
• A dog‑friendly office

Working at Vinted

Individual Learning Budget

We invest in your professional growth! As part of our commitment to continuous learning, we offer an annual learning budget to support your personal and career development through courses, certifications, workshops and more.

Hybrid Work

We’ve adopted a hybrid workplace model where 2 days in the office are recommended but not enforced. It’s up to you and your team to decide on the exact days you’ll spend working together in person.

Equal Opportunity

The Vinted Group is committed to building an inclusive workplace where people from all walks of life feel a sense of belonging. We welcome applications from people of all backgrounds, identities and life experiences. At Vinted, all applicants are treated fairly without regard to their race, age, religion or belief, sex, national origin, citizenship, gender identity, sexual orientation, disability, or any other protected characteristic.

The annual gross salary range for this position is: €100.300—€132.000 EUR