SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
GetYourGuide is seeking a Senior Security GRC Manager to own security governance, risk, and compliance for the Security team. You will shape how the organization meets regulatory obligations including NIS2, PCI DSS, and SOX, embedding compliance into day-to-day operations rather than treating it as a pre-audit fire drill. You will report to the Head of Security and collaborate closely with Engineering, IT, Legal & Privacy, GRC, Internal Controls, and Internal Audit.
Key responsibilities include:
• Own the security policy framework: write, maintain, and shepherd security policies and standards through approval cycles, keeping the policy register current.
• Run cyber risk management: maintain the cyber risk register, facilitate risk assessments with system and business owners, track treatment plans to closure, and report top risks to leadership as input to enterprise risk strategy.
• Run security compliance programs: coordinate PCI DSS, SOX, ITGC, NIS2, and ISO 27001 readiness activities. Serve as the primary Security contact for external auditors and assessors.
• Build continuous evidence: maintain one unified control framework mapped across regulations in the GRC platform (Vanta), and automate evidence collection with Engineering and IT so audits draw on live operational data.
• Manage regulatory obligations with Legal: translate regulatory requirements into concrete controls, support incident reporting procedures, and manage training and approval cycles.
• Review third parties: run the security assessment step during vendor intake and reassessment in collaboration with Procurement, Legal, and GRC.
• Measure what works: define control KPIs, track maturity against NIST CSF, and conduct internal reviews to close the loop.
This is a builder role with the backing to set direction, write frameworks, and ensure they stick.
REQUIREMENTS:
• 5+ years in security GRC, security compliance, or IT audit, ideally at a technology or online platform company.
• Hands-on experience running at least two of: ISO 27001, PCI DSS, SOX ITGC, SOC 2, or NIS2—owning controls, preparing evidence, and taking audits through to clean results.
• Track record of writing policies and standards that were approved, adopted, and enforced.
• Experience designing or running a risk methodology and register, with demonstrated ability to get risk owners outside Security to act on findings.
• Technical depth to discuss cloud (AWS), SaaS, identity and access, and software delivery with engineers; ability to distinguish evidence from paperwork.
• Experience with a GRC platform (Vanta, Drata, or similar) and instinct to automate repeat work, including with AI tools.
• Clear, concise English writing and ability to explain risk in business terms to leadership.
PREFERRED QUALIFICATIONS:
• CISA, CISM, CRISC, CISSP, or ISO 27001 Lead Implementer/Auditor certification.
• Experience with NIS2 or German BSI framework; German language skills.
• Background in regulated environments (financial services, payments) or scale-ups preparing for greater regulatory scrutiny.
• Familiarity with the Three Lines model and experience working alongside Internal Audit and enterprise risk teams.
