Engineering Manager, GRC and Assurance

We are looking for an Engineering Manager to lead GRC and Assurance in Group Security: a team of seven today, growing even more in 2027. The team owns risk management, compliance and audit liaison, second-line security assurance, AI governance, third-party risk, business continuity and security culture.

Vinted spans three distinct entities: Marketplace, Vinted Go, and Vinted Payments, our regulated payments institution. That means handling a fast-moving regulatory landscape covering core privacy (GDPR, CCPA), payment licenses, incoming mandates like DORA, NIS2, and the EU AI Act, alongside driving our 2027 ISO 27001 certification. In most companies, governance runs quietly in the background. At Vinted, it’s core architecture.

We are looking for a practitioner rather than a documenter: someone who leads from the front, turns requirements into controls that work, and grows the people around them through hands-on work.

In this position, you’ll

• Deliver ISO 27001 by 2027: Own the scope, audits, and a single control set covering NIS2 and DORA (with PCI DSS managed separately).
• Map our compliance stack: Build the master map across all three businesses (what applies, when, and liability) to unblock key decisions.
• Run governance like engineering: Turn controls into code, automate evidence, and serve as the first user for Group Security’s new posture platform.
• Lead and grow the team: Manage seven functions, develop specialists on Lead Implementer/Auditor tracks, and add three new hires through early 2027.

• You have run a security governance or compliance function through a certification or a regulator's examination, ISO 27001 or something comparable.
• You think like an engineer about governance: you can say how a control can be automated and how evidence gets collected without a spreadsheet.
• You can hold several regimes in your head at once and tell a real obligation from an assumed one.
• You develop specialists rather than delivering around them, and you will say something is not compliant when nobody wants to hear it.

• The opportunity to benefit from our share options programme
• 25 working days of holiday
• Access to all the tools & tech needed for work
• Home office support: we provide IT workstation equipment and a personal budget of up to 540 for home workplace furniture
• Private health insurance
• Mental and emotional health support through the Mindletic app
• Frequent team-building events
• A personal monthly budget for shopping on Vinted
• The opportunity to spend up to 90 days per year, 21 of which can be spent working outside of the EU - on a workation
• A dog-friendly office
• In Vilnius office: Gym & in-house meals at friendly prices
• In Kaunas office: a monthly lunch allowance, and a once-a-week provided in-house lunch and breakfast