Senior GRC Engineer (Security)
Own and mature ICEYE’s security governance, risk and compliance program across multiple jurisdictions, ensuring ISO 27001, NIS2, NIST and CRA compliance for a space-tech and defence-focused company.
- Compensation
- Not disclosed
- Location
- Espoo
- Work setup
- Hybrid
- Seniority
- Senior
- Employment
- Full time
- Experience
- Not specified
- Category
- Security
- Posted
Skills
Must have
- Eligible for being cleared for a Personal Security Clearance as necessary as well as a citizenship or a permanent residency in the European Union.
- Technical skills that allow you to interpret compliance requirements towards the product function; this includes being able to fluently discuss modern software architecture and development, deployment
- Proven hands-on experience running ISO 27001 (implementation, internal audit, or certification maintenance) in a real organisation, not just theoretical knowledge or external auditing experience.
- Working knowledge of NIS2, CRA, and how their obligations translate into practical controls and reporting.
- Strong stakeholder management skills, with the ability to influence product management, engineering, IT, legal and leadership without formal authority.
- Experience building or maintaining a risk register and running quantified risk assessments.
- Comfortable operating independently across multiple countries and regulatory regimes.
- Awareness of emerging AI governance frameworks (ISO 42001, NIST AI Risk Management Framework, EU AI Act) as well as NIST frameworks
Nice to have
- Relevant certifications such as CISSP, CISM, CISA, CRISC, ISO 27001 Lead Implementer or Lead Auditor.
- Experience in defence, space, aerospace or another regulated/sovereign-sensitive industry.
- Exposure to classified information handling frameworks (EUCI, NATO equivalents, or national security clearance regimes).
- A well-rounded skillset of using language models for automation.
Full description
Role highlights:
- Senior GRC Engineer (Security)
- Location: Espoo, Finland
- Department: Product Security
- Reports to: VP Product Security
- Employment type: Permanent
- Workplace model: Hybrid
- Employment is subject to applicable security screening (incl. SUPO, where required)
Why this role matters:
As Senior GRC Engineer (Security), you'll mature ICEYE's Security Governance, Risk and Compliance program across a multi-country, multi-regulator footprint, including Finland, Germany, Spain, Poland, the UK and Greece amongst others. ICEYE operates at the intersection of commercial space technology and sovereign defence, so our compliance posture (ISO 27001, NIS2, NIST, and national frameworks) has to be credible to customers who include governments and defence agencies. You'll be the person who keeps that posture accurate, current and audit-ready, maps client and national requirements to internal ICEYE requirements, as a senior individual contributor. This role will be working closely with all the ICEYE Security team domains, ICEYE IT, ICEYE product management and the Program Management Office, Engineering and Sales.
Who We Are
**ICEYE is the world leader in sovereign intelligence from space. We deliver persistent monitoring capabilities to detect and respond to changes in any location on Earth.
ICEYE owns the world's largest and most advanced SAR (synthetic aperture radar) satellite constellation. To our customers we provide intelligence with unmatched quality, latency and revisit times, in any weather, day or night. To governments who choose to operate their own constellation we provide this proven capability as a sovereign system.
ICEYE-built constellations serve customers in defence and intelligence, environmental monitoring, insurance and emergency management. We enable fast decisions that contribute to a safer future.
Founded and headquartered in Finland, ICEYE operates globally with over 1000 employees across Europe, North America, the Middle East, and Asia-Pacific.
Your day-to-day responsibilities**
The position will evolve according to the needs of the company and the growing team. Initially, the position has two main aspects, which are adjacent and many initiatives will cross both, especially in terms of overlapping requirements and compliance evidence:
- Product requirements and compliance:
- Ensure clients’ and their national security requirements are at all times clearly translated accurately to ICEYE internal requirements across product, IT, and other ICEYE functions, and we can clearly communicate those towards existing and new clients.