Duco

GRC Analyst

Brak informacji o wynagrodzeniu

SeniorHybryda·WrocławFull-time

#464392·Dodano 13 dni temu·2

Źródło: Duco

Aplikuj teraz

Tech Stack / Keywords

ISO 27001SOC 1SOC 2ISMSDORACISACRISCJira Confluence Claude

Podsumowanie oferty

Support Duco’s external security audit programme and initially own enterprise risk management, including the risk register and reporting. Contribute to information security assurance and AI governance for Duco’s enterprise data automation platform, including audits against ISO 27001, SOC 1 and SOC 2.

Wymagania

At least five years’ experience in Information Security or a comparable role.
Hands-on experience supporting external audits (ISO 27001, SOC 1 and/or SOC 2 Type II), including evidence collection, control testing and direct engagement with auditors.
Experience in technology risk management and information security, focused on risk identification, assessment and mitigation.
Understanding of technology systems and cyber/technology risk management activities, including control effectiveness assessments, reporting and mitigation tracking, and the ability to translate technical findings into clear business impact.
Experience managing or supporting Information Security assessments of third parties.
Experience supporting an established Information Security Management System (ISMS) and maintaining security accreditations such as ISO 27001, SOC 1 and SOC 2.
Professional fluency in English and confidence engaging directly with UK-based stakeholders and external auditors.
A track record of working effectively in a fast-paced, collaborative environment.
Excellent communication, documentation and stakeholder management skills.

Desirable:

Experience in Financial Services or a similarly regulated industry.
ISO 27001 Lead Auditor or Lead Implementer, CISA or CRISC certification.
IT audit experience at a Big Four or comparable firm.
Familiarity with the Digital Operational Resilience Act (DORA).
Working knowledge of Claude, Rovo, Jira and Confluence.

Obowiązki

Technology risk management (initial phase):

Own the enterprise risk register and the frameworks governing risk appetite, exception management and risk prioritisation.
Ensure technology risks are identified, quantified, communicated and managed, with an emphasis on root cause analysis and remediation recommendations.
Conduct Information Security risk assessments across the technology estate and physical locations, and contribute to the end-to-end risk management lifecycle.
Present risk reporting to Duco’s Executive Leadership Team at Risk Committee meetings.

Audit, assurance and compliance:

Support audit readiness, including evidence collection and control walkthroughs, for ISO 27001, SOC 1 and SOC 2 audits.
Monitor and test control design and operating effectiveness, identify gaps, and strengthen risk posture and regulatory compliance.
Track audit findings and remediation actions through to closure.
Maintain compliance with Duco’s security certifications and accreditations: ISO 27001, SOC 1 and SOC 2.
Support client audits and wider assurance activities.

AI governance:

Support reviews of complex or higher-risk AI use cases and formulate recommendations for senior stakeholders.
Contribute to practical technical standards for responsible AI across development, testing, validation, deployment, monitoring and retirement.

Policy, third-party risk and security culture:

Support development and maintenance of the Information Security Policy Framework in alignment with risk appetite, applicable legislation and industry standards.
Support third-party risk assessments.
Maintain an understanding of the current and emerging threat landscape.
Promote adherence to security policies and foster an Information Security culture across the organisation.

Benefity

Annual performance-based bonus.
Private medical insurance.
Life insurance.
Multisport Program.
Unlimited annual holiday.
Enhanced family leave.
Employee Assistance Programme.
Four volunteering days off.
Home working allowance.
Opportunity to work abroad for up to six weeks per year.
Personal learning and development opportunities with an annual dedicated budget.
Referral bonus.
Spot Rewards.
Employee of the Month and Employee of the Year awards.
Wellbee.

Premie

Opieka zdrowotna

Ubezpieczenie

Karta sportowa

Płatne święta

Płatny urlop

Dofinansowanie szkoleń

Duco

4 aktywne oferty

Zobacz wszystkie oferty

Aplikuj teraz