Duco Technology Poland Sp. z o.o.

GRC Analyst

15k - 18k PLN15 000 - 18 000 PLN/ mies./ mies.UoPUmowa o pracę (brutto)

SeniorZdalnie·WrocławFull-time·Umowa o pracę

#464459·Dodano 24 dni temu·5

Źródło: nofluffjobs.com

Aplikuj teraz

Tech Stack / Keywords

ISO 27001SOC 2SOC 1ISMSDORACISACRISCClaude Jira Confluence

Podsumowanie oferty

As a Senior GRC Analyst, you will support the external audit programme and initially own the Enterprise Risk Management Framework. The role focuses on audit and assurance, technology and business risk, and security controls, including ISO 27001, SOC 1 and SOC 2.

Wymagania

At least 5 years of experience in Information Security or a comparable role.
Hands-on experience supporting external audits (ISO 27001, SOC 1 and/or SOC 2 Type II), including evidence collection, control testing and direct engagement with auditors.
Experience in technology risk management and information security, focused on risk identification, assessment and mitigation.
Strong understanding of technology systems and cyber/technology risk management activities, including control effectiveness assessments, reporting and mitigation tracking, and translating technical findings into clear business impact.
Experience managing or supporting Information Security assessments of third parties.
Experience supporting an established Information Security Management System (ISMS) and maintaining security accreditations such as ISO 27001, SOC 1 and SOC 2.
Professional fluency in English and confidence engaging directly with UK-based stakeholders and external auditors.
A track record of working effectively in a fast-paced, collaborative environment.
Excellent communication, documentation and stakeholder management skills.

Nice to have:

Experience in Financial Services or a similarly regulated industry.
ISO 27001 Lead Auditor or Lead Implementer, CISA or CRISC certification.
IT audit experience at a Big Four or comparable firm.
Familiarity with the Digital Operational Resilience Act (DORA).
Working knowledge of Claude, Rovo, Jira and Confluence.

Obowiązki

Own the enterprise risk register and the frameworks governing risk appetite, exception management and risk prioritisation.
Identify, quantify, communicate and manage technology risk, including root cause analysis and remediation recommendations.
Conduct Information Security risk assessments across the technology estate and physical locations, and contribute to the end-to-end risk management lifecycle.
Present risk reporting to the Executive Leadership Team at Risk Committee meetings.
Support audit readiness, including evidence collection and control walkthroughs for ISO 27001, SOC 1 and SOC 2 audits.
Monitor and test control design and operating effectiveness, identify gaps, and strengthen risk posture and regulatory compliance.
Track audit findings and remediation actions through to closure.
Maintain compliance with security certifications and accreditations, including ISO 27001, SOC 1 and SOC 2.
Support client audits and wider assurance activities.
Support reviews of complex or higher-risk AI use cases and formulate recommendations for senior stakeholders.
Contribute to practical technical standards for responsible AI across development, testing, validation, deployment, monitoring and retirement.
Support development and maintenance of the Information Security Policy Framework in alignment with risk appetite, applicable legislation and industry standards.
Support third-party risk assessments.
Maintain an understanding of the current and emerging threat landscape.
Promote adherence to security policies and foster an Information Security culture across the organisation.

Benefity

Sport subscription.
Private healthcare.
International projects.

Karta sportowa

Opieka zdrowotna

Duco Technology Poland Sp. z o.o.

2 aktywne oferty

Zobacz wszystkie oferty

Aplikuj teraz