Cyber Resilience Act (CRA) Officer

Role Purpose:
Lead and coordinate the organization’s compliance with the EU Cyber Resilience Act. Own product cybersecurity governance required by the CRA: risk assessments, secure-by-design evidence, vulnerability management, incident reporting to authorities, technical documentation (including SBOMs), and post-market monitoring across product lifecycles.

We offer:

We offer:

• Join a fast-growing tech leader shaping the future of intralogistics.

• Work in an international environment with diverse, talented teams.

• Enjoy flexibility with adaptable working hours and up to 40% remote work.

• Benefit from an attractive compensation package, including a company car, meal vouchers, and comprehensive insurance.

• Recharge with 36 vacation days to maintain a healthy work-life balance.

Tasks and Qualifications:

Key Responsibilities:

CRA compliance program:

• Design, run and continuously improve the organisation’s CRA compliance program and roadmap to meet the 2026/2027 timelines.

• Ensure continuous improvement and support to our business after Dec.2027

• Translate legal/regulatory requirements into product-level policies, processes, checklists and controls.

• Work with internal security tools (SBOM, Incident and vulnerability tracking, PSIRT platform) and responsible teams to continuously improve tooling requirements. Vulnerability & incident management

• Maintain and run the vulnerability management and coordinated disclosure process for all products.

• Ensure capability to detect, triage and report relevant security incidents and actively exploited vulnerabilities to the competent authorities within CRA timeframes (initial notifications and follow-up reports). Commentato [RC1]: Added suggestion

• Coordinate with or lead PSIRT / CERT / SOC teams and product teams to ensure timely fixes and communications.

Product security lifecycle & evidence:

• Ensure products follow secure-by-design and secure-by-default practices; verify and document security risk assessments, threat models, and mitigations for product portfolios.

• Manage generation and maintenance of technical documentation required by CRA (risk assessments, security testing reports, SBOMs, update policies, support period statements, etc.).

• Monitor product life cycle and align with product security lifecycle. Document all vulnerabilites across life of product ranges and software versions. Ensure a clean record of post-mortem and vulnerability documentation

Conformity & supplier management:

• Coordinate internal and external conformity assessment activities; support audits and third-party assessors.

• Oversee supply-chain security requirements, third-party components (including open-source) governance, and supplier attestations.

• Regulatory liaison & reporting

• Act as the organisation’s point of contact for CRA-related questions and formal communications with national competent authorities and, where relevant, EU bodies.

• Prepare and submit required notifications and reports, and ensure records retention for CRA compliance.

Training, governance & awareness:

• Develop and deliver CRA-specific training for product, engineering, legal, compliance, support and sales teams.

• Participate in / chair product security governance forums; report status to senior management (CISO, Head of Legal, VP Product).

• Continuous monitoring & improvement

• Define KPIs, run periodic assessments, maintain roadmaps to close gaps, and lead remediation programs.

• Keep abreast of CRA guidance, ENISA and European Commission updates, and incorporate changes into the compliance program.