IT Security Governance, Risk & Compliance Analyst

• Experience in IT compliance, Information Security GRC, IT risk, IT audit, third-party security risk, or a related field
• Hands-on experience collecting, validating, and maintaining audit and control evidence
• Understanding of security controls and experience with control testing, gap identification, and remediation tracking
• Knowledge of information security and assurance frameworks such as SOC 2, ISO 27001, NIST, CIS Controls, or similar
• Understanding of risk assessment and risk treatment principles
• Ability to maintain accurate control records, findings, remediation actions, owners, and deadlines
• Strong attention to detail and ability to work with sensitive information
• Clear written and verbal communication skills with both technical and non-technical stakeholders
• Good English communication skills

• Experience with SOC 2, DORA, CySEC, or other financial-services regulatory requirements
• Experience with third-party/vendor security risk management, including supplier assessments, security questionnaires, and due diligence
• Experience with GRC platforms such as ServiceNow GRC, OneTrust, Archer, Vanta, Drata, Hyperproof, or similar
• Experience preparing or delivering security awareness activities, phishing simulations, onboarding, or role-based security training
• Relevant certifications such as CISA, CRISC, CISM, ISO 27001 Lead Auditor/Implementer, or similar
• Experience supporting internal or external audits
• Experience working in FinTech, financial services, SaaS, or another regulated environment

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company's approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)

We are looking for an IT Compliance Analyst/Information Security GRC Analyst to join our Security team and help strengthen the effectiveness and transparency of our security controls.

In this role, you will work across security compliance, control assurance, third-party risk, and security awareness. You will collaborate with Security, Legal, Procurement, technical and business teams to ensure controls are supported by reliable evidence, risks are identified and tracked, and the organization remains ready for audits and regulatory requirements.

This is a great opportunity for someone who enjoys hands-on GRC work, wants to take ownership of processes, and is interested in developing expertise across multiple areas of information security compliance.

• Collect, validate, organize, and maintain audit and security-control evidence
• Test assigned security controls, identify gaps, and prepare clear and traceable evidence packages
• Support internal and external audits, including SOC 2, DORA, and CySEC-related assurance activities
• Maintain control records, evidence repositories, findings, remediation actions, owners, and deadlines
• Perform third-party security assessments, including supplier tiering, due diligence, questionnaire reviews, and analysis of assurance evidence
• Assess security risks related to SaaS providers, ICT providers, outsourced services, and critical vendors
• Track supplier findings, treatment plans, reassessment dates, and remediation progress
• Collaborate with Security, Procurement, Legal, technical teams, and business stakeholders
• Support security-awareness campaigns, employee onboarding, phishing simulations, and role-based training
• Maintain awareness and training completion data and follow up on outstanding actions
• Prepare clear, evidence-based compliance and security-risk reporting
• Escalate control gaps, overdue evidence, critical supplier findings, and other significant risks through established processes