Cyber Resilience Act (CRA) Officer

Role Purpose: Lead and coordinate the organization’s compliance with the EU Cyber Resilience Act. Own product cybersecurity governance required by the CRA: risk assessments, secure-by-design evidence, vulnerability management, incident reporting to authorities, technical documentation (including SBOMs), and post-market monitoring across product lifecycles. We offer: We offer: Join a fast-growing tech leader shaping the future of intralogistics. Work in an international environment with diverse, talented teams. Enjoy flexibility with adaptable working hours and up to 40% remote work . Benefit from an attractive compensation package , including a company car, meal vouchers, and comprehensive insurance. Recharge with 36 vacation days to maintain a healthy work-life balance. Tasks and Qualifications: Key Responsibilities: CRA compliance program: • Design, run and continuously improve the organisation’s CRA compliance program and roadmap to meet the 2026/2027 timelines. • Ensure continuous improvement and support to our business after Dec.2027 • Translate legal/regulatory requirements into product-level policies, processes, checklists and controls. • Work with internal security tools (SBOM, Incident and vulnerability tracking, PSIRT platform) and responsible teams to continuously improve tooling requirements. Vulnerability & incident management • Maintain and run the vulnerability management and coordinated disclosure process for all products. • Ensure capability to detect, triage and report relevant security incidents and actively exploited vulnerabilities to the competent authorities within CRA timeframes (initial notifications and follow-up reports). Commentato [RC1]: Added suggestion • Coordinate with or lead PSIRT / CERT / SOC teams and product teams to ensure timely fixes and communications. Product security lifecycle & evidence: • Ensure products follow secure-by-design and secure-by-default practices; verify and document security risk assessments, threat models, and mitigations for product portfolios. • Manage generation and maintenance of technical documentation required by CRA (risk assessments, security testing reports, SBOMs, update policies, support period statements, etc.). • Monitor product life cycle and align with product security lifecycle. Document all vulnerabilites across life of product ranges and software versions. Ensure a clean record of post-mortem and vulnerability documentation Conformity & supplier management: • Coordinate internal and external conformity assessment activities; support audits and third-party assessors. • Oversee supply-chain security requirements, third-party components (including open-source) governance, and supplier attestations. • Regulatory liaison & reporting • Act as the organisation’s point of contact for CRA-related questions and formal communications with national competent authorities and, where relevant, EU bodies. • Prepare and submit required notifications and reports, and ensure records retention for CRA compliance. Training, governance & awareness: • Develop and deliver CRA-specific training for product, engineering, legal, compliance, support and sales teams. • Participate in / chair product security governance forums; report status to senior management (CISO, Head of Legal, VP Product). • Continuous monitoring & improvement • Define KPIs, run periodic assessments, maintain roadmaps to close gaps, and lead remediation programs. • Keep abreast of CRA guidance, ENISA and European Commission updates, and incorporate changes into the compliance program.