Governance, Risk & Compliance Expert – GRC

Responsibilities

• You support our clients in defining and implementing their information security strategy
• You organize, structure and manage security projects
• You implement and further develop information security management systems (ISMS)
• You contribute to the creation and continual improvement of security policies and processes (e.g., Incident Response, Security Policies)
• You analyze and assess security risks using established frameworks (e.g., ISO 27005, EBIOS RM)
• You identify and monitor operational, compliance and security risks
• You define and implement security KPIs to measure security performance
• You support clients in complying with relevant cybersecurity and data protection regulations (e.g., NIS2, DORA, GDPR, NIST)
• You analyze organizations’ security posture and identify improvement measures
• You conduct internal audits and support compliance processes
• You coordinate incident response and support incident analysis
• You monitor remediation plans following incidents or audits and ensure their implementation
• You develop measures to improve the security posture
• You deliver training and awareness activities on information security and GRC policies
• You promote the adoption of security standards and best practices across organizations

Requirements

• Completed Bachelor’s or Master’s degree in Cybersecurity, Information Security or a comparable qualification
• At least 5 years of experience in a comparable role within Governance, Risk & Compliance or Information Security
• Solid knowledge of the ISO 2700X standards (ISO 27001, ISO 27002, ISO 27005)
• Experience with risk management methods such as EBIOS RM
• Knowledge of relevant regulatory requirements such as NIS2, DORA or GDPR
• Experience implementing or further developing an ISMS
• Excellent analytical skills and a structured way of working
• Fluent German and English
• Certifications such as ISO 27001 Lead Implementer / Lead Auditor or ISO 27005 Risk Manager are advantageous
• Additional certifications such as CISM, CISSP, CRISC or CISA are a plus
• Willingness to travel within the DACH region