GRC Specialist (German-speaking)

We're hiring a GRC Specialist (Governance Risk and Compliance) to strengthen our compliance function as Secfix scales into more frameworks, mid-market customers, and a growing compliance team. This role sits at the intersection of compliance delivery, content, and team support. You'll own the compliance knowledge that lives inside our platform, run internal audits, support our customer success team, and act as the compliance voice for customers, auditors, and product. You'll work closely with our co-founder & CISO and our CS Lead.

Responsibilities

Build and maintain compliance frameworks in the Secfix platform (ISO 27001, TISAX, SOC 2, GDPR, NIS 2, DORA, ISO 27017/27018, ISO 42001, C5, and more); Own internal audits for customers end to end, from kickoff through to the final report for their external audit; Keep several audits moving at once and on schedule; Implement ISO 27001 and adjacent frameworks end-to-end for customers; Own the quality of compliance content in the platform (policies, automated checks, evidence templates, Compliance enable playbooks for CSMs, security awareness trainings and more); Close framework gaps and incorporate auditor feedback into team practice and platform improvements; Partner with product and engineering to translate compliance gaps into structured product work; Collaborate closely with CS, Product, and Founders to align compliance, customer, and roadmap priorities; Deepen relationships with certification partners and train auditors on the Secfix platform

Requirements

German (C1/C2) and English (fluent) are a must; 3+ years of hands-on information security and GRC experience; Led at least 1 successful ISO 27001 certification project as an implementer and/or auditor at a startup or mid-market company; Run at least 2 internal audits; Hands-on experience with a GRC platform like Secfix or similar; Real depth in at least one framework beyond ISO 27001 (TISAX, SOC 2, GDPR, NIS2, or similar); Strong project management skills with the ability to break down ambiguous initiatives into concrete deliverables, prioritize ruthlessly, and ship; Excellent written communication, especially producing clear, precise compliance content for diverse audiences; Strong ownership mindset, operating as an individual contributor without waiting for direction; Bachelor's degree in computer science, software engineering, or a related technical field, or equivalent hands-on technical experience

Nice to have

Experience mentoring or coaching colleagues in a compliance, audit, or GRC context; Experience in a startup environment; A PECB ISO 27001 Lead Auditor certification or a direct equivalent

Benefits

100% remote work with a virtual office in Gather; Competitive local salaries at or above market; Generous equity package; Mentorship from top VCs, accelerators, and world-class mentors; €1,000 annual personal development budget; Home office budget and access to co-working spaces; 26 days holiday plus local public holidays; Comprehensive health coverage; Annual retreat; Company-wide events; Latest tech equipment (MacBook, monitors, headphones)