GRC Engineer; m​/f​/d NIS, DORA, CRA, ISO 27001 & ISO

Hybrid: mostly remote within Germany, occasionally at our Bonn office.

You turn regulation into machine-readable controls and automated GRC processes – with VamiGRC, for clients in critical infrastructure, finance and industry.

• Build and evolve integrated management systems (ISMS to ISO 27001, AIMS to ISO 42001) – from scope and Statement of Applicability to certification readiness
• Implement regulatory requirements from NIS2, DORA, the CRA and the EU AI Act, including gap analyses and remediation plans
• Model controls, cross-mappings and frameworks in VamiGRC (OSCAL) and automate evidence and workflows with AI agents
• Quantitative risk management, supplier assessments (TPRM) and preparation of internal and external audits
• Work closely with the product team: requirements from client projects flow straight into the platform

• Several years of experience in GRC, ISMS or IT compliance, ideally in regulated industries
• In-depth knowledge of ISO 27001 and at least two of NIS2, DORA, CRA, ISO 42001 or the EU AI Act
• Technical understanding (cloud, IAM, vulnerability management) and a passion for automation, e.g. with Python, APIs or OSCAL
• Excellent German (at least C1) and good English

ISO 27001 ISO 42001 NIS2 DORA CRA EU AI Act OSCAL

• Build and evolve integrated management systems (ISMS to ISO 27001, AIMS to ISO 42001) – from scope and Statement of Applicability to certification readiness
• Implement regulatory requirements from NIS2, DORA, the CRA and the EU AI Act, including gap analyses and remediation plans
• Model controls, cross-mappings and frameworks in VamiGRC (OSCAL) and automate evidence and workflows with AI agents
• Quantitative risk management, supplier assessments (TPRM) and preparation of internal and external audits
• Work closely with the product team: requirements from client projects flow straight into the platform

• Several years of experience in GRC, ISMS or IT compliance, ideally in regulated industries
• In-depth knowledge of ISO 27001 and at least two of NIS2, DORA, CRA, ISO 42001 or the EU AI Act
• Technical understanding (cloud, IAM, vulnerability management) and a passion for automation, e.g. with Python, APIs or OSCAL
• Excellent German (at least C1) and good English
• A plus: ISO 27001 or ISO 42001 Lead Auditor, CISA, CISM or BSI IT-Grundschutz Practitioner

ISO 27001 ISO 42001 NIS2 DORA CRA EU AI Act OSCAL

Your contact Valeri Milke Founder & CEO, Vami Sec

Linked In

Flexible work from anywhere in Germany – we trust in results.

Certifications, training, and conferences – we invest in your growth.

Autonomous work on exciting projects for renowned clients.

Small, highly motivated team with flat hierarchies and direct communication.

Competitive salaries, bonuses, and benefits – transparent and performance-based.

Your work makes organizations and critical infrastructure more secure.