EU remote
Engineering Manager, GRC and Assurance
About this role
Brief info about Vinted Our mission is to make second-hand the first choice, and we're looking for people who want to help us get there. Every day, we work together to help our members buy and sell pre-loved clothing and lifestyle items, giving each piece a second life – or even a third. The Vinted Group is made up of three business units that support this mission: Vinted Marketplace is Europe’s leading platform for second-hand fashion and a go-to destination for all kinds of pre-loved items, with a growing range of categories.
Our platform connects millions of members across 20+ markets, helping great items find a new life. Vinted Go enhances the shipping experience with a vast network of over 500,000 pick-up and drop-off points, partnering with more than 60 carriers across Europe, with added services like item verification for peace of mind on high-value pieces. Vinted Pay is the newest part of the Vinted Group, dedicated to bringing secure, reliable payments to buyers and sellers across Europe.
Seamlessly integrated into the Vinted app, it helps keep every transaction safe, efficient, and easy for our members. Founded in 2008 in Lithuania, Vinted began as a way for friends to find new homes for clothes they no longer needed. In 2019, we became Lithuania's first unicorn! Today, our headquarters remain in Vilnius, and we've grown with offices across Europe, supported by a team of over 2,000 people. Information about the position We are looking for an Engineering Manager to lead GRC and Assurance in Group Security: a team of seven today, growing even more in 2027.
The team owns risk management, compliance and audit liaison, second-line security assurance, AI governance, third-party risk, business continuity and security culture. Vinted spans three distinct entities: Marketplace, Vinted Go, and Vinted Payments, our regulated payments institution. That means handling a fast-moving regulatory landscape covering core privacy (GDPR, CCPA), payment licenses, incoming mandates like DORA, NIS2, and the EU AI Act, alongside driving our 2027 ISO 27001 certification.
In most companies, governance runs quietly in the background. At Vinted, it’s core architecture. We are looking for a practitioner rather than a documenter: someone who leads from the front, turns requirements into controls that work, and grows the people around them through hands-on work. In this position, you’ll Deliver ISO 27001 by 2027: Own the scope, audits, and a single control set covering NIS2 and DORA (with PCI DSS managed separately).