Data Protection & Quality Management Officer

Role

As Data Protection & Quality Management Officer at Orcrist Technologies, you own our data protection framework and build and operate our ISO 9001 quality management system. You act as our appointed Data Protection Officer under GDPR and lead the development, maintenance, and continuous improvement of our QMS.

Both are independent staff functions reporting directly to the C-Level Management. You advise, monitor, audit, and document; the business remains responsible for operational decisions and implementation.

We build AI platforms for customers in the defence and government sector. Data protection and quality management are essential to our business and customer trust. As the company grows, you will build these structures hands-on, working closely with engineering, product, people, IT, and our Information Security Officer.

What you'll do

• Build and maintain our data protection management system, including policies, processes, and documentation.
• Act as our appointed DPO under Art. 37–39 GDPR and § 38 BDSG, advising management and teams on GDPR, BDSG, and TDDDG requirements.
• Monitor compliance, including records of processing activities, processor agreements, TOMs, data protection impact assessments, and data subject requests.
• Advise on privacy by design, international data transfers, retention, and personal data breaches.
• Build and maintain our ISO 9001 QMS, including process documentation, quality objectives, risk-based thinking, and continual improvement.
• Own the internal audit programme, track nonconformities and corrective actions, and coordinate certification and surveillance audits.
• Prepare the annual management review and report on data protection risks, audit findings, and improvement priorities.
• Train teams on data protection and quality management requirements.
• Work closely with the ISB to align overlapping requirements while maintaining clear responsibilities and independence.
• Travel occasionally to our offices in Berlin, Dresden, and Hamburg, as well as to other workshop locations across Germany, to facilitate workshops, training sessions, and audits.
• On-site presence is expected to be more frequent during the initial implementation phase and primarily driven by audits and specific business needs thereafter.

About you

• Certified DPO training (GDD, TÜV, DEKRA, or equivalent) and at least 3 years of hands-on GDPR experience.
• At least 2 years of practical ISO 9001 experience and an internal auditor qualification based on ISO 19011.
• Experience building and maintaining data protection management systems and QMS documentation.
• The independence to challenge management, the judgement to prioritise risks, and a pragmatic approach to implementation.
• Hands-on mindset and confidence working with technical and non-technical stakeholders.
• Willingness to travel occasionally within Germany and work in a hybrid setup, combining remote work with on-site activities.
• German and English at C1 level or above.

Nice-to-haves

• Experience in a software, SaaS, or AI company.
• Familiarity with ISO/IEC 27001.
• Familiarity with AQAP-Standards.
• CIPP/E or comparable certification.
• Experience leading a first ISO 9001 certification.
• Experience with GRC platforms or document control systems.

What we offer

• Remote-first, Germany-wide: Work from wherever you do your best work, with regular team gatherings in Berlin and other off-site locations.
• Flexibility by default: Flexible working hours help you make work fit your life.
• Your setup, your way: Get a personal home-office equipment budget to create a workspace that works for you.
• 30 days of vacation: Take the time you need to recharge and come back with fresh energy.
• Keep growing: We invest in your personal and professional development.
• Get rewarded for impact: Performance bonuses are tied to agreed objectives and key results.
• A warm welcome: Every new team member gets a welcome goodie bag.
• Good people, good times: From summer and Christmas parties to regular team gatherings, we make time to celebrate together.
• A mission that matters: Work on challenges with tangible impact on public safety and national security.