Senior Security GRC Expert (all genders)

THE ROLE & THE TEAM
 

As a Senior Security GRC Expert in the Information Security - Security Risk & Governance Team, you will be at the forefront of safeguarding trust for our customers, stakeholders, and employees. By expertly identifying, assessing, and managing security risks, you will directly influence the security posture of our internal applications and third-party relationships, becoming the go-to expert and a key architect of our evolving Security Risk Management process.

In this pivotal role, you will help maintain and advance our security posture by taking ownership of our risk management processes. As a key stakeholder, you will translate complex business requirements into clear, actionable security operational solutions, implementing and ensuring our security framework remains robust and effective as we continue to grow.
 

WHAT WE’D LOVE YOU TO DO (AND LOVE DOING)

• Manage Security Compliance: Implement, maintain, and continuously improve the information security compliance framework. Experience with Secure Controls Framework (SCF) is a plus.

• Ensure Regulatory Adherence: Monitor, enforce, and advise on compliance with DORA, GDPR, PCI-DSS, SOC2, NIS2, CRA, and other relevant regulations.

• Develop Security Governance: Contribute to the creation, review, and upkeep of information security policies, procedures, and controls.

• Drive Risk Management: Design, implement, and maintain the information security risk management framework for projects, systems, and processes.

• Measure Risk Management Effectiveness: Develop KPIs to track the effectiveness of risk management efforts.

• Report to Leadership: Prepare and present regular reports on security risks, compliance, and improvements.

WE'D LOVE TO MEET YOU IF

• You have 6+ years of experience working in Security Governance, Risk and Compliance functions.

• You demonstrate strong communication skills and good interpersonal skills.You can communicate security risk-related concepts to technical and nontechnical audiences.

• You have experience in interpreting and implementing security and privacy regulations and frameworks (e.g., NIST CSF, GDPR, ISO 2700x, SOC 2, PCI DSS, NIS2, CRA) into actionable security operational requirements.

• You have a familiarity with the Secure Control Framework (SCF).

• You have exceptional attention to detail, strong program/project management skills, analytical proficiency, and experience in operationalizing and developing scalable security processes in complex environments.

• You have security certifications (e.g. CISSP, CRISC, CISM, ISO 27001 Lead Auditor/Implementer) as a plus.

OUR OFFER

Zalando provides a range of benefits, here’s an overview of what you can expect. Ask your Talent Acquisition Partner to learn more about what we offer.

• 27 days of holiday a year to start for full-time employees (+1 day for every calendar year up to 30 days)

• 40% off fashion and beauty products sold and shipped by Zalando, 30% off Lounge by Zalando, discounts from external partners

• Family support, including counselling and dedicated services for parents and carers

• Company pension scheme

• Employee shares programme

• Health and wellbeing options, including Wellhub

• Mental health support and coaching

• Development through our training platform and biannual peer-to-peer review

• 2 paid volunteering days a year

• Relocation assistance (subject to prior agreement)

INCLUSIVE BY DESIGN

If you think you have what it takes, we encourage you to apply even if you don't meet every single requirement. You may just be the right candidate for this or other roles!

At Zalando, our vision is to be the leading European technology platform for fashion and lifestyle – one that thrives on diversity and is truly inclusive by design. We believe that diverse teams fuel innovation and creativity, and we actively seek out talent from all backgrounds.

We actively seek to reduce bias in our hiring and employment processes, focusing on your qualifications, skills, and contributions. To support this, we kindly ask that you refrain from including personal details such as your photo, age, or marital status in your CV, ensuring a fair and equitable evaluation based solely on your abilities and potential.

We are committed to providing an exceptional and accessible candidate experience for everyone. If you require any accommodations to support you throughout the hiring process, please let us know – we are here to assist you.

Discover more about our commitment to creating a diverse and inclusive workplace: https://jobs.zalando.com/en/our-culture/diversity-and-inclusion

Please note that all applications from this job page must be completed using the online form - we do not accept applications via e-mail. Once reviewed, our recruiters will contact applicants via an official Zalando email address (@zalando.de).

In some cases we also work with a selection of headhunters and agencies to fill specific roles. Please note that neither Zalando nor our recruiting partners will ask for any kind of payment to apply for a job or attend an interview.

If you have any questions about our recruitment process, please take a look at our FAQ page.

About Zalando

Founded in Berlin in 2008, Zalando is the leading European technology platform for fashion and lifestyle. Connecting 62 million active customers with more than 7,000 brands across 29 markets, our operations are built on a unique AI-powered data and infrastructure platform. For our customers, our multi-app approach - comprising Zalando, ABOUT YOU, and Lounge by Zalando - delivers an inspiring, highly personalized shopping experience, serving different customers with different needs. For our partners, we are building the operating system for e-commerce. Through ZEOS, Tradebyte, and SCAYLE, we open our logistics, software, and service capabilities to brands and retailers, enabling them to seamlessly scale their businesses across borders.