Role Purpose
Lead and coordinate the organization's compliance with the EU Cyber Resilience Act. Own product cybersecurity governance required by the CRA: risk assessments, secure-by-design evidence, vulnerability management, incident reporting to authorities, technical documentation (including SBOMs), and post-market monitoring across product lifecycles.
We Offer
•Join a fast-growing tech leader shaping the future of intralogistics.
•Work in an international environment with diverse, talented teams.
•Flexibility with adaptable working hours and up to 40% remote work.
•An attractive compensation package, including a company car, meal vouchers, and comprehensive insurance.
•36 vacation days to maintain a healthy work-life balance.
Key Responsibilities
CRA compliance program:
•Design, run and continuously improve the organisation's CRA compliance program and roadmap to meet the 2026/2027 timelines.
•Ensure continuous improvement and support to the business after Dec. 2027.
•Translate legal/regulatory requirements into product-level policies, processes, checklists and controls.
•Work with internal security tools (SBOM, Incident and vulnerability tracking, PSIRT platform) and responsible teams to continuously improve tooling requirements.
Vulnerability & incident management:
•Maintain and run the vulnerability management and coordinated disclosure process for all products.
•Ensure capability to detect, triage and report relevant security incidents and actively exploited vulnerabilities to the competent authorities within CRA timeframes (initial notifications and follow-up reports).
•Coordinate with or lead PSIRT / CERT / SOC teams and product teams to ensure timely fixes and communications.
Product security lifecycle & evidence:
•Ensure products follow secure-by-design and secure-by-default practices; verify and document security risk assessments, threat models, and mitigations for product portfolios.
•Manage generation and maintenance of technical documentation required by CRA (risk assessments, security testing reports, SBOMs, update policies, support period statements, etc.).
•Monitor product life cycle and align with product security lifecycle. Document all vulnerabilities across life of product ranges and software versions. Ensure a clean record of post-mortem and vulnerability documentation.
Conformity & supplier management:
•Coordinate internal and external conformity assessment activities; support audits and third-party assessors.
•Oversee supply-chain security requirements, third-party components (including open-source) governance, and supplier attestations.
Regulatory liaison & reporting:
•Act as the organisation's point of contact for CRA-related questions and formal communications with national competent authorities and, where relevant, EU bodies.
•Prepare and submit required notifications and reports, and ensure records retention for CRA compliance.
Training, governance & awareness:
•Develop and deliver CRA-specific training for product, engineering, legal, compliance, support and sales teams.
•Participate in / chair product security governance forums; report status to senior management (CISO, Head of Legal, VP Product).
Continuous monitoring & improvement:
•Define KPIs, run periodic assessments, maintain roadmaps to close gaps, and lead remediation programs.
•Keep abreast of CRA guidance, ENISA and European Commission updates, and incorporate changes into the compliance program.
