Information Security Governance, Risk & Compliance Manager
Europe | Full-time
Responsibilities
- Own and develop the Information Security GRC strategy, roadmap, operating model, and governance cadence
- Lead security governance, regulatory assurance, cyber risk, third-party security risk, policy lifecycle, and security-awareness oversight
- Establish clear ownership for security controls, risks, exceptions, evidence, and remediation actions
- Coordinate SOC 2, DORA/CySEC-related assurance, internal and external audits, and regulatory requests
- Maintain cyber-risk and exception registers and ensure material risks are treated, accepted, or escalated
- Lead security aspects of ICT supplier tiering, due diligence, reassessment, and high-risk supplier decisions
- Develop practical security policies, standards, controls, and guidance
- Ensure audit and assurance evidence is reliable, traceable, and reusable
- Track control gaps, findings, and remediation commitments and escalate material risks
- Partner with Security, IT, Engineering, Product, Platform, Legal, and business teams on control design and risk-based decisions
- Prepare concise GRC and risk reporting for the CISO and executive stakeholders
- Build, develop, and manage the GRC team, including responsibilities, goals, and performance expectations
- Improve GRC efficiency through automation, reusable evidence, better data quality, and responsible AI-assisted workflows
Requirements
- Strong practical experience in Information Security GRC, cyber/technology risk, security compliance, or assurance
- Hands-on experience with recognized frameworks such as SOC 2, ISO 27001, DORA, PCI DSS, NIST CSF, COBIT, or similar
- Experience establishing or operating security controls, risk registers, exception processes, and assurance programs
- Strong understanding of control design, operating effectiveness, evidence quality, findings, and remediation
- Experience coordinating internal or external audits and regulatory or assurance activities
- Practical experience with cyber risk assessment, risk treatment, risk acceptance, and escalation
- Understanding of third-party and ICT supplier security risk
- Ability to translate regulatory and security requirements into practical controls and processes
- Strong stakeholder management skills and ability to work effectively with technical, business, and executive audiences
- Sufficient technical understanding of cloud, infrastructure, identity, IT operations, and product development to work effectively with technical teams
- Experience leading a team, function, program, or complex cross-functional initiatives
- Strong ownership, prioritization, and decision-making skills
We offer
- 20 paid vacation days per year
- 10 paid sick leave days per year
- Public holidays according to company policy
- Medical budget
- Remote work opportunity
- Professional education budget
- Language learning budget
- Wellness budget (gym membership, sports gear, etc.)