CybersecurityEngineer

## What You Will Do Regulatory & Compliance Lead CRA readiness for Gravis products with digital elements: scoping, product classification, gapassessments against essential requirements, risk analysis, control design, and remediationroadmaps Translate CRA, NIS2, and Machinery Regulation requirements into actionable control frameworksand policies; map to ISO 27001/27002/27036, NIST CSF, NIST SP 800-161, NIST SSDF, CISControls, and OWASP Maintain comprehensive technical documentation to support conformity assessments, CE marking, and engagement with Notified Bodies Stay current on emerging threats, regulatory changes, and best practices in product security,supply chain security, and GRC Product Security Establish and mature product security capabilities: secure development lifecycle, secure updateprocesses, vulnerability handling, coordinated vulnerability disclosure (CVD), PSIRT setup andoperations, SBOM generation, management, and vulnerability triage Conduct risk assessments and threat modelling for products and suppliers; define mitigationstrategies, metrics, and KPIs Participate in incident and alert response reviews; propose and implement improvement actions Assess and improve the security hardening of enterprise and embedded solutions Secure Engineering Write secure code for critical system components in C, C++, Python, and/or Rust Conduct manual and automated code reviews with a strict focus on security vulnerabilities (OWASP Top 10, CWE) Define and enforce secure coding guidelines and SAST/DAST tooling across engineering teams Mentor and upskill engineers on secure development best practices Collaboration & Communication Collaborate cross-functionally with security, engineering, product, operations, legal, and compliance teams; facilitate workshops and drive change Produce clear, high-quality deliverables: assessment reports, control designs, implementationplans, policies, process maps, and training materials Regularly monitor and report on security metrics, s