Engineering Manager, Security Governance & Compliance

Vinted; Oslo; Hybrid; NOK 1,083,000 - 1,425,000; Full time

Benefits offered by this job

Share options

25 days paid annual leave

Newest MacBook models

EAP and mental health support

Frequent team-building events

Home office budget up to €540

Daily lunch allowance

Pension plan 12% total contrib.

NS mobility card

Workation up to 90 days/year

Dog-friendly office

Job summary

Vinted is seeking an Engineering Manager to lead GRC and Assurance in Group Security, guiding a seven-person team responsible for risk management, compliance and audit liaison, second-line security assurance, AI governance, third-party risk, business continuity and security culture.

You will turn requirements into automated controls, drive ISO 27001 readiness by 2027, map the compliance stack across all three Vinted entities, and mentor security professionals while maintaining hands-on execution.

Qualifications

• Experience running security governance or compliance functions through certification or regulator examinations (ISO 27001).
• Ability to engineer governance: automate controls and evidence collection without spreadsheets.
• Ability to manage multiple regimes and distinguish real obligations from assumptions.
• Experience developing specialists rather than delivering around them.

Responsibilities

• Deliver ISO 27001 by 2027: own scope, audits, and a single control set covering NIS2 and DORA.
• Map the compliance stack across all three Vinted businesses to unblock decisions.
• Run governance like engineering: turn controls into code, automate evidence collection, act as early user for posture platform.
• Lead and grow the team: manage seven functions and hire through early 2027.

Skills

Security governance

Compliance management

ISO 27001 experience

Automation mindset

People development

Education

ISO 27001 certification or equivalent

Job description

Vinted is seeking an Engineering Manager to lead GRC and Assurance in Group Security, guiding a seven-person team responsible for risk management, compliance and audit liaison, second-line security assurance, AI governance, third-party risk, business continuity and security culture.

You will turn requirements into automated controls, drive ISO 27001 readiness by 2027, map the compliance stack across all three Vinted entities, and mentor security professionals while maintaining hands-on execution.