DORA Controls Mapping Specialist

General info:

Model of work: hybrid (3 days work from office Gdynia/Gdansk)

Type of contract: B2B, long-term cooperations

Rate: up to 150 PLN nett + vat/ hour

Summary: The primary goal of the DORA Controls Mapping Specialist is to support Nordic financial institutions in assessing their readiness for the EU Digital Operational Resilience Act (DORA). This requires evaluating the alignment of existing controls with DORA requirements, leading workshops with stakeholders, and producing quality assessments to identify and address compliance gaps.

Main Responsibilities:

• Interpret DORA ICT risk management and digital operational resilience requirements in a financial services context.
• Translate DORA requirements into practical control expectations and assessment criteria.
• Perform requirements-to-controls mapping across policies, processes, systems, and governance arrangements.
• Conduct gap assessments, documenting current-state maturity, compliance gaps, risks, and remediation recommendations.
• Assess control design effectiveness and, where applicable, operating effectiveness.
• Review and challenge evidence provided by stakeholders, ensuring completeness and relevance.
• Apply quality assurance to assessment outputs.
• Lead workshops, interviews, and sessions with various stakeholders.
• Facilitate decision-making and communicate findings to senior stakeholders.
• Produce high-quality deliverables, including assessment workpapers, control matrices, and more.

Key Requirements:

• Demonstrable hands-on experience with DORA, especially ICT risk management and operational resilience.
• Strong understanding of ICT risk, IT governance, and operational resilience within financial institutions.
• Proven experience in conducting regulatory or control-framework gap assessments.
• Experience in requirements-to-controls mapping and control design effectiveness assessments.
• Ability to turn regulatory requirements into clear control requirements.
• Excellent written and verbal communication skills in English, with proficiency in a Nordic language being advantageous.

Nice to Have:

• Experience with related frameworks such as EBA Guidelines, NIS2, and ISO 27001.
• Background in technology risk, IT audit, or compliance.
• Relevant certifications such as CISA, CRISC, or CISSP.