GRC Jobs in Germany: Employers, Laws and Job Titles

What GRC jobs are there in Germany?

GRC jobs in Germany are mostly compliance, audit, risk and data protection roles at banks and fintechs in Frankfurt and Berlin, plus consulting in Munich and Düsseldorf. Three German laws shape the work alongside the GDPR: the BDSG on data protection, the BSI Act that carries NIS2, and the KI-MIG on artificial intelligence.

When we checked on November 9, 2026, the German roles on our board came from Deutsche Bank (one of them at DWS), Morgan Stanley, N26, Solaris, Capco and Fast Retailing (UNIQLO), plus a Stripe role for Europe, the Middle East and Africa that lists Berlin among its locations. The list below updates with the board, so it shows only open roles.

• GRC Careers listings, Frankfurt: sanctions oversight, anti-financial crime, internal audit and outsourcing control at banks.
• GRC Careers listings, Berlin: complaints compliance and audit at N26, operational risk at Deutsche Bank, and data protection at Fast Retailing.
• GRC Careers listings, Munich and Düsseldorf: GRC technology consulting at Capco (ServiceNow GRC and integrated risk management), plus regulatory reporting (Meldewesen) in Munich.
• Regulation (EU) 2024/1620, Art. 4: the EU's new anti-money laundering authority, AMLA, has its seat in Frankfurt am Main.
• BDSG § 40(1): a private company, whether in Hamburg or Munich, is supervised by the data protection authority set up under its state's law.

When does a German employer need a Datenschutzbeauftragter?

When it usually has at least 20 people constantly working on automated processing of personal data, which is a German rule on top of the GDPR. A few kinds of processing trigger the duty at any headcount.

• BDSG § 38(1): a controller or processor names a data protection officer (Datenschutzbeauftragter) if it usually has at least 20 people constantly working on automated processing of personal data.
• BDSG § 38(1), second sentence: headcount stops mattering for processing that needs a data protection impact assessment, or for processing personal data as a business for transfer or for market or opinion research.
• GDPR Art. 37(1): the EU triggers still apply, namely public bodies, large-scale regular and systematic monitoring, and large-scale processing of special categories of data.
• GDPR Art. 37(6): the DPO can be on staff or work under a service contract, so the job can sit in-house or with an outside provider.

What did NIS2 change for GRC work in Germany?

It sorted regulated companies into two classes and put duties on the management board. Germany wrote NIS2 into a new BSI Act (BSIG), Article 1 of the law of December 2, 2025, in force since December 6, 2025 (BSIG, official text).

• BSIG § 28(1) and (2): in the sectors listed in Annexes 1 and 2, important entities (wichtige Einrichtungen) start at 50 employees, or more than €10 million in both annual turnover and balance sheet total. In Annex 1 sectors, particularly important entities (besonders wichtige Einrichtungen) start at 250 employees, or more than €50 million in turnover and more than €43 million in balance sheet total. Operators of critical facilities are always particularly important.
• BSIG § 32(1): an early warning within 24 hours of learning of a significant incident, a notification within 72 hours, and a final report one month after that.
• BSIG § 33(1): registration with the BSI within three months of first qualifying.
• BSIG § 38: the management board must put the risk measures in place and oversee them, is liable to the company for damage it culpably causes, and must take part in regular training.
• BSIG § 28(6): financial entities under DORA, Regulation (EU) 2022/2554, such as banks and insurers, are exempt from the BSIG's risk, reporting and management sections. For a Frankfurt bank, that work runs under DORA.
• BSIG § 45(1): every federal agency must appoint an Informationssicherheitsbeauftragter, an information security officer.

When does the EU AI Act apply in Germany, and who enforces it?

Most of the AI Act has applied since August 2, 2026, and the Bundesnetzagentur enforces it in Germany, with BaFin covering AI in regulated finance. The high-risk rules come later.

• AI Act Art. 113, consolidated text of July 27, 2026: the Act applies from August 2, 2026; rules for high-risk systems listed in Annex III apply from December 2, 2027, and for Annex I products from August 2, 2028.
• KI-MIG § 2(1): the Bundesnetzagentur is the market surveillance authority unless the law says otherwise. The KI-MIG has been in force since July 29, 2026.
• KI-MIG § 2(3): BaFin, the financial supervisor, covers AI systems tied directly to regulated financial activity at the firms it supervises, such as banks and insurers.
• AI Act Art. 4 with Art. 113(a): providers and deployers must take measures to support the AI literacy of their staff, a duty that has applied since February 2, 2025.

The full timeline is on our EU AI Act hub, and open roles that work on the Act are under EU AI Act jobs. To test yourself, try the free EU AI Act readiness game.

What does "(m/w/d)" mean in a German job title?

It stands for männlich, weiblich, divers: male, female, diverse. German employers add it to show the job is open to everyone.

• AGG § 11, with § 7(1): a job may not be advertised in breach of the ban on discrimination.
• AGG § 1: sex is one of the protected grounds.
• PStG § 22(3): the birth register can record a person as divers, which is where the third letter comes from.
• GRC Careers listings, November 2026: variants include "(m/w/d)" at Solaris, "(f/m/x)" and "(d/m/w)" at Deutsche Bank, "(m/f/d)" for a DWS role, and gender-inclusive spellings such as Manager*innen.
• Search tip: leave the marker out and search for the role itself.

Which German GRC job titles match which English ones?

Most German listings on our board are written in English, because the employers are global banks and consultancies. These pairs help you search in both languages.

Our data protection officer job description shows what the DPO role covers.

What links Germany and southern Brazil?

Two centuries of German and Italian settlement in the South, and since 2026 an EU decision that lets personal data flow from Germany to Brazil. Germany also won the 2014 World Cup final in Brazil, 1-0 over Argentina after extra time at the Maracanã in Rio de Janeiro on July 13, 2014 (The FA match report).

• Rückert, Revista Brasileira de História & Ciências Sociais, 2013, pp. 206 and 213: German settlers reached the São Leopoldo colony in Rio Grande do Sul in 1824, and most settled in the Depressão Central, where they could ship goods by river.
• Same article, p. 213: Italians followed into the highlands of the Serra, where three imperial colonies stood by 1875: Dona Isabel, Conde D'Eu and Caxias.
• IBGE, history of Blumenau: in Santa Catarina, seventeen settlers reached the colony of Hermann Blumenau, a German, on September 2, 1850, in a region where Indigenous peoples, among them the Kaingang and Xokleng, already lived.
• Loregian-Penkal and Stival-Soares, Revista X, 2020, p. 821: Talian, the language Italian immigrants formed in Brazil, was recognized as a Brazilian Cultural Reference in 2014.
• Commission Implementing Decision (EU) 2026/179 of January 26, 2026, Art. 1: Brazil ensures an adequate level of protection for personal data sent from the EU to controllers and processors in Brazil subject to its General Data Protection Law, the LGPD.
• GDPR Art. 45(1): a transfer based on an adequacy decision needs no specific authorization, so a German company can send personal data to an LGPD-covered subsidiary or vendor in Brazil on that basis.

How do you apply from abroad, or hire into Germany?

Start with our international and remote listings, and set an alert so new German roles reach you.

• Job seekers: browse international GRC jobs and remote GRC jobs, or set a job alert.
• Neighbors: read our Switzerland GRC jobs guide or see Poland GRC jobs.
• Employers: post a job, and give the German title, the English title and the (m/w/d) marker in the text.