Cybersecurity GRC Manager
Pubblicato il 30-10-2026 - Stealth Startup in Pavia
About Us
We are an early-stage technology company operating at the intersection of Energy and AI infrastructure, focused on developing a new generation of efficient and scalable computing infrastructure. Our approach combines distributed computing, modular infrastructure and energy efficiency to support the rapidly growing demand for AI and high-performance computing. The company is developing a new model for deploying compute capacity in a flexible and scalable way, with a strong focus on efficiency, sustainability, reliability and responsible infrastructure development. This is an opportunity to join a growing team at an early stage and contribute directly to the development of a new infrastructure platform, working at the intersection of power, data centers and advanced computing. Position Type Part of the Security function, initially reporting to the Director of Software Engineering, then directly to the CEO ahead of our first certification audit, to ensure the independence of the compliance function. Role Overview We are seeking a Cybersecurity GRC Manager to build and run the security governance, risk and compliance of the company. Our self-contained, outdoor-deployable compute units form sovereign, multi-tenant GPU clusters operating under European and Italian regulation. You will build our information security management system from scratch, own the certification roadmap for our markets, and take the company through its first certification. You will work alongside the Security Engineer, who owns the technical controls. This role is the natural path to a CISO position as the company scales. What You Will Deliver This is a high-impact, high-ownership role: you will define how we prove to customers,
auditors and regulators that our infrastructure is secure. Within 6 months: You will deliver the foundations of our security programme: a gap analysis against ISO/IEC 27001 and NIS2, a clear position on our NIS2 obligations in Italy, the ISMS scope, core policies and risk register, an incident notification procedure, and a certification roadmap agreed with the CEO, based on our target customers and markets. Within 12 months: You will run an operating ISMS ready for a first certification audit, with supplier and host-site security requirements in place, and you will have started the certification or qualification chosen for our priority market.
Key Responsibilities
* Build and run the information security management system: policies, risk management, statement of applicability and continuous improvement.
* Define how the company organizes for security: roles and responsibilities (RACI) and the interfaces between security, engineering, operations and legal; set the security requirements and deadlines the engineering teams commit to.
* Own the certification roadmap: decide which certifications and qualifications to pursue, when and why, and lead their implementation.
* Own security regulatory compliance (NIS2, GDPR security obligations) and define the open-source licence policy together with Legal.
* Own audit readiness: plan audits,
collect evidence from engineering teams and track remediation.
* Own the incident management process: classification, regulatory notification, customer communication and post-incident review, with the Security Engineer handling the technical response.
* Run third-party and supply-chain security (suppliers, hardware vendors, security clauses in contracts), and define security requirements for host sites in our deployment agreements, together with the Security Engineer and Operations.
* Answer customer security due diligence, run security awareness and report the security posture to management. Requirements
* Bachelor’s degree in Computer Science, Engineering, Information Security, Law or equivalent field
* 7+ years of experience in information security governance, risk and compliance, in a cloud provider, data center operator, telecom operator, technology company or consultancy
* Hands-on experience taking an organization through ISO/IEC 27001 certification, at least once end to end
* Working knowledge of NIS2 and of GDPR security requirements
* Ability to understand cloud and infrastructure architectures well enough to challenge engineers
* Ability to work in a fast-paced, early-stage environment with a high degree of ownership and autonomy
* Fluent English and Italian Nice to Have
* ISO/IEC 27001 Lead Implementer or Lead Auditor, CISM, CISSP or equivalent certification
* Experience with a cloud certification or qualification scheme (e.g. ACN qualification, SecNumCloud, BSI C5)
* Experience with business continuity management (e.g. ISO 22301)
* Prior experience at a startup or scale-up, building a compliance programme from scratch Location Milan, Italy.