About the role

The consultant will ensure organizational compliance with data privacy laws and cybersecurity standards while managing risk frameworks. They will also conduct privacy impact assessments and provide expert guidance on cybersecurity strategy and policy implementation.

What they look for

Cybersecurity Governance Risk Management Compliance ServiceNow GRC Privacy Impact Assessment Data Protection Information Security Policy Development Risk Register Management Vulnerability Management Incident Management Cloud Risk Third-party Risk Cybersecurity Maturity Regulatory Compliance Stakeholder Communication

Requirements

Candidates must have at least 9 years of IT experience, including 5+ years in cybersecurity GRC and risk management. A minimum of four professional certifications such as CISA, CISM, or CISSP is required, along with C1 level English proficiency.

Full description

Cybersecurity Governance Risk and Compliance Consultant (Warsaw, 70% remote) – EU Public Organisations

Profile: Cybersecurity Governance Risk and Compliance Consultant - Level Advanced.

Securiy Clearance: Is required (security screening procedure must be initiated within first 45 days of assignment) - RESTREINT UE/EU RESTRICTED.

Place of performance: Frontex Headquarters in Warsaw. 70% remote + 30% on-site.

Travel: Not foreseen.

Minimum required scoring for interview (%): 70%.

Duration of the mission: 48 months.

Award criteria: 35% Price / 65% Quality.

Minimum level of education: Level 7.

Minimum English language skills (CEFR): C1.

Minimum IT relevant professional experience (years): 9 years.

Minimum experience at similar position (years): 8 years in relevant IT roles.

Rate: 460-488€/day NWH; 610-634€/day EWH; 12,70€/hour OnC.

· NWH: 230days x4 years.

Required certificates

At least 4 certifications among:

· CISA (ISACA Certified Information Systems Auditor).

· CISM (ISACA Certified Information Security Manager).

· CRISC (ISACA Certified in Risk and Information Systems Control).

· CISSP (ISC2 Certified Information Systems Security Professional).

· CGRC (ISC2 Certified in Governance, Risk and Compliance).

· CSSLP (ISC2 Certified Secure Software Lifecycle Professional).

· CCSP (ISC2 Certified Cloud Security Professional).

· CISSP-ISSMP (ISC2 Certified Information Systems Security Management Professional).

· GSNA (GIAC Certified Systems and Network Auditor).

· GCCC (GIAC Certified Critical Controls).

· GIAC Certified ISO-27000 Specialist.

· ISO 27001 Lead implementer or equivalent.

· ISO 27001 Lead Auditor or equivalent.

· ISO 27005 Risk Manager or equivalent.

· or for any listed above, an equivalent alternative certification recognized internationally (subject to acceptance as a valid credential by the Contracting Authority).

Knowledge and skills Knowledge:

· Cybersecurity related laws, regulations and legislations.

· Cybersecurity standards, methodologies and frameworks.

· Cybersecurity policies.

· Legal, regulatory and legislative compliance requirements, recommendations and best practices.

· Privacy impact assessment standards, methodologies and frameworks.

Skills:

· Comprehensive understanding of the business strategy, models and products and ability to factor into legal, regulatory and standards’ requirements.

· Carry out working-life practices of the data protection and privacy issues involved in the implementation of the organisational processes, finance and business strategy.

· Lead the development of appropriate cybersecurity and privacy policies and procedures that complement the business needs and legal requirements; further ensure its acceptance, comprehension and implementation and communicate it between the involved parties.

· Conduct, monitor and review privacy impact assessments using standards, frameworks, acknowledged methodologies and tools.

· Explain and communicate data protection and privacy topics to stakeholders and users

· Understand, practice and adhere to ethical requirements and standards.

· Understand legal framework modifications implications to the organisation’s cybersecurity and data protection strategy and policies.

· Collaborate with other team members and colleagues.

Specific requirements:

· Minimum 5+ years of experience in cybersecurity GRC, with clear focus on cybersecurity risk management.

· Proven experience in designing or operatiationalising a cyber risk management framework.

· Hands-on experience in using ServiceNow GRC (IRM / Risk / Policy and Compliance modules).

· Demonstrated experience maintaining and managing a cybersecurity risk register.

· Experience integrating risk management with: Vulnerability management, Incident management, Cloud risk, Third-party risk.

· Experience contributing to cybersecurity maturity improvement programmes.

Typical tasks and responsibilities

· Ensure compliance with and provide legal advice and guidance on data privacy and data protection standards, laws and regulations.

· Identify and document compliance gaps.

· Conduct privacy impact assessments and develop, maintain, communicate and train upon the privacy policies, procedures.

· Enforce and advocate organisation’s data privacy and protection program.

· Ensure that data owners, holders, controllers, processors, subjects, internal or external partners and entities are informed about their data protection rights, obligations and responsibilities.

· Act as a key contact point to handle queries and complaints regarding data processing.

· Assist in designing, implementing, auditing and compliance testing activities in order to ensure cybersecurity and privacy compliance.

· Monitor audits and data protection related training activities.

· Cooperate and share information with authorities and professional groups.

· Contribute to the development of the organisation’s cybersecurity strategy, policy and procedures.

· Develop and propose staff awareness training to achieve compliance and foster a culture of data protection within the organization.

· Manage legal aspects of information security responsibilities and third-party relations.