Governance Risk and Compliance Expert

Requirements

• Candidates must hold at least three active certifications from the following list, or direct industry equivalents:
  • Audit & Security: CISA, CISM, GSNA, GCCC, CISSP-ISSMP, GIAC Certified ISO-27000 Specialist
  • Standards & Risk: ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, ISO 27005 Risk Manager, CRISC
  • Authorization & Privacy: CAP ((ISC)²), CRISC
• 5+ years in data protection, with solid experience navigating privacy compliance in high-tech environments, including ICT, EU institutions, the public sector, or tech-heavy enterprises
• 3+ years in privacy documentation, including preparing, mapping, and validating RoPAs, DPIAs, and DPAs by obtaining inputs directly from system owners, SOC teams, and network architects
• 2+ years in technical auditing, including analysis of privileged access rights, data transfers, hosting architectures, and subcontractor data flows
• Exceptional ability to work with incomplete or conflicting IT information, separate assumptions from facts, and identify technical compliance gaps with minimal supervision

Responsibilities

• Align complex IT and cloud operations with European data privacy standards, laws, and regulations
• Conduct and review comprehensive DPIAs and maintain precise Records of Processing Activities (RoPAs)
• Analyze data flows, verify access-control logs, review SIEM exports, and audit data-retention schemes to ensure likely technical reality matches declared policies
• Provide expert counsel on data protection agreements (DPAs), Transfer Impact Assessments (TIAs), and third-party vendor management
• Act as the primary point of contact for data privacy inquiries, complaints, and external audit cooperation
• Design, implement, and deliver engaging privacy awareness training programs for staff to foster a proactive security culture