Responsibilities:

EU REGULATORY & SOVEREIGNTY PROGRAM

• Control and regulatory mapping. Build and maintain mappings between Netskope’s control framework (ISO 27001/27017/27018/27701, SOC 2, CSA STAR) and EU and UK regulatory requirements, including DORA, NIS2, the EU Cyber Resilience Act (CRA), the EU AI Act, GDPR and member-state privacy laws, and the EU Data Act, so a single control set evidences many obligations.
• DORA. Support Netskope’s posture as an ICT third-party service provider to EU financial entities: contractual requirements, customer audit and access rights, incident notification support, exit and resilience provisions, and customer register-of-information requests.
• Cyber Resilience Act. Partner with Product Security and PSIRT on CRA readiness, including vulnerability handling, actively exploited vulnerability and severe incident reporting, SBOM practices, and conformity assessment preparation for in-scope Netskope products such as endpoint clients and appliances.
• EU AI Act. Support AI governance for Netskope’s AI-enabled features: AI inventory, risk classification, transparency obligations, and alignment with ISO/IEC 42001, tracking phased obligations and amendments as they take effect.
• Data and service sovereignty. Partner with Product, Platform Engineering, and Privacy to document how Netskope’s NewEdge data centers, data processing, storage, and metadata handling meet EU and member-state sovereignty and residency expectations; maintain accurate customer-facing sovereignty documentation, data-flow descriptions, and sub-processor information.
• BSI C5. Own Netskope’s C5 attestation, including the move to C5:2025, which aligns with EUCS and NIS2 and is increasingly used as a cloud security benchmark beyond Germany; track its evolution toward broader EU adoption.
• National and sector schemes. Support alignment with other national and emerging EU schemes as needed, including Spain’s Esquema Nacional de Seguridad (ENS), France’s SecNumCloud, and the EU Cybersecurity Certification Scheme for Cloud Services (EUCS).
• Regulatory change. Track guidance from the European Commission, ENISA, the EDPB, and national authorities (e.g., AEPD, CCN-CERT, NCSC); translate changes into gap assessments, owners, and remediation plans.

UK & EU AUDITS AND CERTIFICATIONS

• Audit execution. Lead or support external audits and assessments for UK and EU frameworks, including ISO 27001/27017/27018, BSI C5, Cyber Essentials Plus, UK Ministry of Defence requirements (e.g., DEFSTAN 05-138 and the Defence Cyber Protection Partnership Cyber Security Model), and ENS.
• Evidence, interviews, and findings. Validate evidence for completeness, accuracy, and currency; prepare control owners and participate in auditor interviews; triage findings and nonconformities and track remediation to closure.
• Customer and regulator-driven audits. Coordinate customer audits and on-site or remote assessments, including those exercised under DORA and NIS2 supply-chain requirements.

CUSTOMER & SALES ENABLEMENT

• Trusted advisor. Partner with EMEA sales and sales engineering on customer engagements, clearly communicating with CISOs, security leadership, DPOs, and third-party vendor risk management teams on how Netskope meets EU regulatory and sovereignty requirements.
• Platform and deployment expertise. Explain the Netskope One platform (SWG, CASB, ZTNA, DLP, FWaaS, SD-WAN, and AI security) and its EU deployment: data flows, processing locations, residency options, tenant configuration, and the shared responsibility model.
• Customer compliance outcomes. Help customers map Netskope capabilities to their own obligations under DORA, NIS2, GDPR, the AI Act, and sovereignty requirements (e.g., DLP for personal data, ICT third-party and SaaS risk visibility, and generative AI governance) and guide implementations that support those outcomes.
• Due diligence and enablement. Own EU-focused RFP responses, security questionnaires, DORA and NIS2 supplier assessments, and DPA/security schedule reviews with Legal and Privacy; build reusable content, FAQs, and training so EMEA sales teams can lead first-line compliance conversations.

COLLABORATION

• Partner with Privacy, Legal, Compliance Product Management, Engineering, PSIRT, Corporate IT, and Sales to build EU and UK regulatory requirements into products and processes; exercise independent judgment based on risk to Netskope, raise risks proactively with recommendations, and mentor junior team members.

Requirements:

• 8+ years in security compliance, GRC, audit, or regulatory advisory, ideally with a SaaS, cloud, or security provider or a Big Four advisory practice.
• Strong working knowledge of DORA, NIS2, GDPR, the Cyber Resilience Act, the EU AI Act, ISO 27001, and BSI C5; hands-on experience with Cyber Essentials Plus and UK MOD requirements, and a proven ability to map framework controls to regulatory requirements.
• Solid understanding of cloud and network security architectures; SSE/SASE experience strongly preferred.
• Excellent written and verbal communication, with confidence presenting to senior security leadership and vendor risk teams in plain language.
• Fluent English and Spanish; an additional EU language (e.g., French, German, Italian) is a plus.
• Relevant certifications preferred: ISO 27001 Lead Auditor or Lead Implementer, CISSP, CISM, CISA, CCSP, CIPP/E, or ISO/IEC 42001.
• Right to work in Spain and ability to travel within the EU and UK as needed.

#LI-NN1