Principal - Architecture

Role description

Seeking a German-speaking Principal Cloud Security and GRC Lead with 15+ years of experience in enterprise Governance, Risk and Compliance, Microsoft 365/Azure security, cloud solution architecture, audit and regulatory compliance. The role will lead customer-facing GRC and cloud-security services, establish and operate a resilient GRC framework, support M365 governance and compliance maturity assessment, and translate complex risk and compliance topics into clear business outcomes.

Key Responsibilities
• Lead the customer-facing Cloud Security and GRC service, coordinate a global delivery team, and act as a trusted advisor to stakeholders.
• Establish, maintain and continuously improve the enterprise GRC operating model across policy and compliance management, risk management, audit management, control assurance, evidence management and regulatory reporting.
• Lead implementation and operation of Microsoft Compliance Manager (MCM), Alyne GRC and/or comparable integrated risk management platforms, including configuration, upgrades, migration, workflow design and reporting.
• Drive the M365 Governance, Risk and Compliance maturity assessment: establish the current-state baseline, assess maturity, identify gaps, define the target state and produce prioritized recommendations and a remediation roadmap.
• Use Microsoft Purview, Microsoft Defender for Cloud and relevant Microsoft security/compliance capabilities to support security posture reviews, benchmarking, control validation and actionable recommendations, subject to available licensing and access.
• Architect and govern secure Microsoft Azure and M365 solutions using native security controls, Microsoft Defender capabilities, identity governance and cloud security best practices.
• Perform and coordinate security and compliance risk assessments, control reviews and audit support across cloud and M365 environments; maintain risk, issue, action and evidence registers.
• Support internal and external audits, ensure timely closure of findings and compliance gaps, and provide clear management reporting on risks, exceptions, actions and control effectiveness.
• Align controls with applicable frameworks and regulations, including ISO 27001, NIST CSF, CSA Cloud Controls Matrix, COBIT 2019, GDPR, DORA, SOX ITGC and relevant organizational policies.
• Facilitate solution and control workshops, document high-level and detailed designs, define governance processes and RACI, and maintain current policies, procedures, control narratives and operating documentation.
• Provide strategic guidance for cloud security incidents, risk treatment and exception management, and coordinate with technical, business, legal, privacy, audit and service-management stakeholders.
• Drive project milestones, SLA adherence, governance cadence, escalation management and continuous service improvement; mentor delivery teams and build customer awareness of cloud security and GRC practices.

Specific Requirement
• Near-native German communication capability at C1/C2 level, with strong English communication skills.
• Ability to operate as a senior, customer-facing GRC advisor and explain complex IT GRC, cloud-security and regulatory topics in simple business language.
• Hands-on experience in M365 governance and compliance, Microsoft Compliance Manager, Microsoft Purview and Microsoft security posture assessment.
• Experience establishing an M365 GRC baseline where formal baseline documentation may be incomplete, and converting assessment findings into a practical target-state roadmap.
• Strong experience in Risk Assessment, Audit Support, Report Review, Control Compliance Review, Evidence Management and closure of compliance gaps.
• Practical knowledge of Cloud Controls Matrix, ISO 27001 controls, GDPR and DORA requirements within a regulated financial-services environment.
• Experience managing risk and issue logs, governance reporting, escalations, audit evidence and remediation tracking in a structured managed-services engagement.

Mandatory Skills
• 15+ years of IT/cybersecurity experience with substantial experience in GRC, cloud security and security architecture.
• Enterprise GRC implementation and operations covering policy, risk, compliance, audit, controls, evidence and reporting.
• Microsoft Compliance Manager and Microsoft Purview; strong understanding of Microsoft 365 governance and compliance controls.
• Microsoft Azure native security, Microsoft Defender for Cloud and cloud solution architecture.
• Identity Governance, IT Audit, IT Service Management and ServiceNow GRC/IRM or equivalent workflow platforms.
• Working knowledge of ISO 27001, NIST CSF, CSA CCM, GDPR and DORA.
• Strong project management, customer engagement, stakeholder management, executive communication, documentation and presentation skills.
• German C1/C2 and professional English.

Good-to-Have Skills
• COBIT 2019, SOX ITGC, SIG, ISO 42001, AI for GRC, AI security architecture and architecture governance.
• Experience with Microsoft Defender for Identity, Defender for Cloud Apps, Defender for Endpoint and broader M365 security capabilities.
• Experience designing GRC dashboards, compliance scorecards, automated evidence collection and continuous compliance monitoring.

Education and Certifications
• Bachelor's degree or equivalent experience in Computer Science, Information Systems, Cybersecurity, Mathematics, Statistics or a related field.
• Preferred certifications include any two of: ISO 27001 Lead Implementer/Lead Auditor, CISA, CISM, CRISC, CGEIT, CISSP, CCSK or equivalent recognized cloud/GRC certifications.
• Relevant Microsoft security/compliance and GRC product certifications are desirable.

Expected Deliverables
• M365 GRC current-state baseline and maturity assessment report.
• Control and compliance gap register with risk-based prioritization.
• Target-state GRC and cloud-security architecture, roadmap and implementation recommendations.
• Maintained risk and issue log, escalation summary, audit evidence repository and remediation tracker.
• Governance dashboards, compliance reporting, policies, procedures, RACI and architecture documentation.