Staff GRC Engineer

About the role

As a Staff GRC Engineer you will own and mature ICEYE’s Security Governance, Risk and Compliance program across multiple countries and regulatory regimes. You will ensure the company’s compliance posture (ISO 27001, NIS2, NIST and national frameworks) remains accurate, audit‑ready and aligned with client and governmental requirements.

Key responsibilities

• Translate client and national security requirements into clear internal requirements for product, IT and other functions.
• Maintain evidence of compliance, preferably using compliance‑as‑code approaches.
• Own and continuously improve ICEYE’s ISO 27001 ISMS, including risk assessments, risk register, Statement of Applicability, internal audits and certification cycles.
• Track and operationalise NIS2, CRA and other EU security obligations, turning regulatory text into concrete policies, controls and evidence.
• Run third‑party and vendor security risk assessments and prepare concise compliance and risk reports for senior leadership.
• Act as the primary point of contact for external auditors, certification bodies and regulators on GRC matters.

Required profile

• Eligible for personal security clearance and EU citizenship or permanent residency.
• Proven hands‑on experience implementing and maintaining ISO 27001 in an organisation.
• Working knowledge of NIS2, CRA and how they translate into practical controls and reporting.
• Strong stakeholder‑management skills with the ability to influence product, engineering, IT, legal and leadership without formal authority.
• Comfortable operating independently across multiple countries and regulatory regimes.

Required skills

• ISO 27001 implementation, internal audit and certification maintenance.
• NIS2 and CRA compliance frameworks.
• Risk register creation and quantified risk assessments.
• Compliance‑as‑code concepts.
• Understanding of modern software architecture, development, deployment and release processes.
• Awareness of AI governance frameworks (ISO 42001, NIST AI RMF, EU AI Act) and NIST security frameworks.