Cyber Resilience Act (CRA) Officer

Role Purpose:
Lead and coordinate the organization’s compliance with the EU Cyber Resilience Act. Own product cybersecurity governance required by the CRA: risk assessments, secure-by-design evidence, vulnerability management, incident reporting to authorities, technical documentation (including SBOMs), and post-market monitoring across product lifecycles.
We offer:We offer:
Join a fast-growing tech leader shaping the future of intralogistics.
Work in an international environment with diverse, talented teams.
Enjoy flexibility with adaptable working hours and up to 40% remote work.
Benefit from an attractive compensation package, including a company car, meal vouchers, and comprehensive insurance.
Recharge with 36 vacation days to maintain a healthy work-life balance.
Tasks and Qualifications:
Key Responsibilities:
CRA compliance program:
• Design, run and continuously improve the organisation’s CRA compliance program and roadmap to meet the 2026/2027 timelines.
• Ensure continuous improvement and support to our business after Dec.2027
• Translate legal/regulatory requirements into product-level policies, processes, checklists and controls.
• Work with internal security tools (SBOM, Incident and vulnerability tracking, PSIRT platform) and responsible teams to continuously improve tooling requirements. Vulnerability & incident management
• Maintain and run the vulnerability management and coordinated disclosure process for all products.
• Ensure capability to detect, triage and report relevant security incidents and actively exploited vulnerabilities to the competent authorities within CRA timeframes (initial notifications and follow-up reports). Commentato [RC1]: Added suggestion
• Coordinate with or lead PSIRT / CERT / SOC teams and product teams to ensure timely fixes and communications.
Product security lifecycle & evidence:
• Ensure products follow secure-by-design and secure-by-default practices; verify and document security risk assessments, threat models, and mitigations for product portfolios.
• Manage generation and maintenance of technical documentation required by CRA (risk assessments, security testing reports, SBOMs, update policies, support period statements, etc.).
• Monitor product life cycle and align with product security lifecycle. Document all vulnerabilites across life of product ranges and software versions. Ensure a clean record of post-mortem and vulnerability documentation
Conformity & supplier management:
• Coordinate internal and external conformity assessment activities; support audits and third-party assessors.
• Oversee supply-chain security requirements, third-party components (including open-source) governance, and supplier attestations.
• Regulatory liaison & reporting
• Act as the organisation’s point of contact for CRA-related questions and formal communications with national competent authorities and, where relevant, EU bodies.
• Prepare and submit required notifications and reports, and ensure records retention for CRA compliance.
Training, governance & awareness:
• Develop and deliver CRA-specific training for product, engineering, legal, compliance, support and sales teams.
• Participate in / chair product security governance forums; report status to senior management (CISO, Head of Legal, VP Product).
• Continuous monitoring & improvement
• Define KPIs, run periodic assessments, maintain roadmaps to close gaps, and lead remediation programs.
• Keep abreast of CRA guidance, ENISA and European Commission updates, and incorporate changes into the compliance program.