Cybersecurity Governance Risk and Compliance Consultant

About Company: 

Team Connect is Poland’s leading nearshore and offshore IT provider. Since 2008 we successfully create and develop software for our clients.  We specialize in Agile and DevOps-based software development. From the analysis stage through implementation. We develop backend, frontend, and mobile applications. 

For one of our clients, we are looking for a Cybersecurity Governance Risk and Compliance Consultant.

Location & Delivery Mode: Warsaw, hybrid – 30% onsite / 70% remote. 

Experience Required: At least 9 years post-education, incl. 8+ years in a similar role. 

Required Certificates: 
At least 4 certifications among (must have):
[1] CISA (ISACA Certified Information Systems Auditor)
[2] CISM (ISACA Certified Information Security Manager)
[3] CRISC (ISACA Certified in Risk and Information Systems Control)
[4] CISSP (ISC2 Certified Information Systems Security Professional)
[5] CGRC (ISC2 Certified in Governance, Risk and Compliance)
[6] CSSLP (ISC2 Certified Secure Software Lifecycle Professional)
[7] CCSP (ISC2 Certified Cloud Security Professional)
[8] CISSP-ISSMP (ISC2 Certified Information Systems Security Management Professional)
[9] GSNA (GIAC Certified Systems and Network Auditor)
[10] GCCC (GIAC Certified Critical Controls)
[11] GIAC Certified ISO-27000 Specialist
[12] ISO 27001 Lead implementer or equivalent.
[13] ISO 27001 Lead Auditor or equivalent.
[14] ISO 27005 Risk Manager or equivalent.

or for any listed above, an equivalent alternative certification recognized internationally (subject to acceptance as a valid credential by the Contracting Authority)

Knowledge & Skills: 
Knowledge:
[01] Cybersecurity related laws, regulations and legislations
[02] Cybersecurity standards, methodologies and frameworks
[03] Cybersecurity policies
[04] Legal, regulatory and legislative compliance requirements, recommendations and best practices
[05] Privacy impact assessment standards, methodologies and frameworks

Skills: 
[06] Comprehensive understanding of the business strategy, models and products and ability to factor into legal, regulatory and standards’ requirements
[07] Carry out working-life practices of the data protection and privacy issues involved in the implementation of the organisational processes, finance and business strategy
[08] Lead the development of appropriate cybersecurity and privacy policies and procedures that complement the business needs and legal requirements; further ensure its acceptance, comprehension and implementation and communicate it between the involved parties
[09] Conduct, monitor and review privacy impact assessments using standards, frameworks, acknowledged methodologies and tools
[10] Explain and communicate data protection and privacy topics to stakeholders and users
[11] Understand, practice and adhere to ethical requirements and standards
[12] Understand legal framework modifications implications to the organisation’s cybersecurity and data protection strategy and policies
[13] Collaborate with other team members and colleagues

Specific Requirements: 
[01] minimum 5+ years of experience in cybersecurity GRC, with clear focus on cybersecurity risk management
[02] Proven experience in designing or operatiationalising a cyber risk management framework
[03] Hands-on experience in using ServiceNow GRC (IRM / Risk / Policy and Compliance modules)
[04] Demonstrated experience maintaining and managing a cybersecurity risk register.
[05] Experience integrating risk management with: Vulnerability management, Incident management, Cloud risk, Third-party risk
[05] Experience contributing to cybersecurity maturity improvement programmes.

11. Typical Tasks & Responsibilities: 
- Ensure compliance with and provide legal advice and guidance on data privacy and data protection standards, laws and regulations
- Identify and document compliance gaps
- Conduct privacy impact assessments and develop, maintain, communicate and train upon the privacy policies, procedures
- Enforce and advocate organisation’s data privacy and protection program
- Ensure that data owners, holders, controllers, processors, subjects, internal or external partners and entities are informed about their data protection rights, obligations and responsibilities
- Act as a key contact point to handle queries and complaints regarding data processing
- Assist in designing, implementing, auditing and compliance testing activities in order to ensure cybersecurity and privacy compliance
- Monitor audits and data protection related training activities
- Cooperate and share information with authorities and professional groups
- Contribute to the development of the organisation’s cybersecurity strategy, policy and procedures
- Develop and propose staff awareness training to achieve compliance and foster a culture of data protection within the organization
- Manage legal aspects of information security responsibilities and third-party relations"