Cybersecurity Governance Risk and Compliance Consultant

About Company: Team Connect is Poland’s leading nearshore and offshore IT provider. Since 2008 we successfully create and develop software for our clients. We specialize in Agile and DevOps-based software development. From the analysis stage through implementation. We develop backend, frontend, and mobile applications. For one of our clients, we are looking for a Cybersecurity Governance Risk and Compliance Consultant. Location & Delivery Mode: Warsaw, hybrid – 30% onsite / 70% remote. Experience Required: At least 9 years post-education, incl. 8+ years in a similar role. Required Certificates: At least 4 certifications among (must have):[1] CISA (ISACA Certified Information Systems Auditor)[2] CISM (ISACA Certified Information Security Manager)[3] CRISC (ISACA Certified in Risk and Information Systems Control)[4] CISSP (ISC2 Certified Information Systems Security Professional)[5] CGRC (ISC2 Certified in Governance, Risk and Compliance)[6] CSSLP (ISC2 Certified Secure Software Lifecycle Professional)[7] CCSP (ISC2 Certified Cloud Security Professional)[8] CISSP-ISSMP (ISC2 Certified Information Systems Security Management Professional)[9] GSNA (GIAC Certified Systems and Network Auditor)[10] GCCC (GIAC Certified Critical Controls)[11] GIAC Certified ISO-27000 Specialist[12] ISO 27001 Lead implementer or equivalent.[13] ISO 27001 Lead Auditor or equivalent.[14] ISO 27005 Risk Manager or equivalent.or for any listed above, an equivalent alternative certification recognized internationally (subject to acceptance as a valid credential by the Contracting Authority)

Knowledge & Skills: Knowledge:[01] Cybersecurity related laws, regulations and legislations[02] Cybersecurity standards, methodologies and frameworks[03] Cybersecurity policies[04] Legal, regulatory and legislative compliance requirements, recommendations and best practices[05] Privacy impact assessment standards, methodologies and frameworks

Skills: [06] Comprehensive understanding of the business strategy, models and products and ability to factor into legal, regulatory and standards’ requirements[07] Carry out working-life practices of the data protection and privacy issues involved in the implementation of the organisational processes, finance and business strategy[08] Lead the development of appropriate cybersecurity and privacy policies and procedures that complement the business needs and legal requirements; further ensure its acceptance, comprehension and implementation and communicate it between the involved parties[09] Conduct, monitor and review privacy impact assessments using standards, frameworks, acknowledged methodologies and tools[10] Explain and communicate data protection and privacy topics to stakeholders and users[11] Understand, practice and adhere to ethical requirements and standards[12] Understand legal framework modifications implications to the organisation’s cybersecurity and data protection strategy and policies[13] Collaborate with other team members and colleagues

Specific Requirements: [01] minimum 5+ years of experience in cybersecurity GRC, with clear focus on cybersecurity risk management[02] Proven experience in designing or operatiationalising a cyber risk management framework[03] Hands-on experience in using ServiceNow GRC (IRM / Risk / Policy and Compliance modules)[04] Demonstrated experience maintaining and managing a cybersecurity risk register.[05] Experience integrating risk management with: Vulnerability management, Incident management, Cloud risk, Third-party risk[05] Experience contributing to cybersecurity maturity improvement programmes.11. Typical Tasks & Responsibilities: - Ensure compliance with and provide legal advice and guidance on data privacy and data protection standards, laws and regulations- Identify and document compliance gaps- Conduct privacy impact assessments and develop, maintain, communicate and train upon the privacy policies, procedures- Enforce and advocate organisation’s data privacy and protection program- Ensure that data owners, holders, controllers, processors, subjects, internal or external partners and entities are informed about their data protection rights, obligations and responsibilities- Act as a key contact point to handle queries and complaints regarding data processing- Assist in designing, implementing, auditing and compliance testing activities in order to ensure cybersecurity and privacy compliance- Monitor audits and data protection related training activities- Cooperate and share information with authorities and professional groups- Contribute to the development of the organisation’s cybersecurity strategy, policy and procedures- Develop and propose staff awareness training to achieve compliance and foster a culture of data protection within the organization- Manage legal aspects of information security responsibilities and third-party relations'