Cybersecurity Governance, Risk & Compliance (GRC) Consultant

Lifted, an Upwork Company™; San Donato Milanese; On-site; EUR 42,000 - 60,000; Part time

Job summary

Lifted, an Upwork Company™, seeks an Information Security professional to support COET srl in governance, risk, and compliance. The role focuses on identifying, assessing, monitoring, and reporting cybersecurity risks across the organization, including incident response and policy development.

The contractor will work with the Cybersecurity team to ensure conformity with NIS2, ISO27001, GDPR, and other regulatory requirements.

Qualifications

• Experience in Information Security governance, risk management, compliance, and incident response.
• Knowledge of frameworks/regulations: NIST, NIS2, ISO 27001, GDPR.
• Fluency in Italian and English is required.
• Strong communication and stakeholder management skills.
• Ability to work independently and collaborate with cybersecurity and business teams.

Responsibilities

• Conduct cybersecurity risk assessments for COET srl.
• Analyze threats, vulnerabilities, control effectiveness, and residual risks.
• Maintain and update cybersecurity risk registers.
• Track risk mitigation and remediation activities through completion.
• Develop and monitor cybersecurity policies, standards, and control requirements.
• Assist with internal and external cybersecurity audits.
• Coordinate evidence collection and remediation tracking.
• Prepare materials for management and governance reviews.
• Escalate significant cybersecurity risks and emerging trends.
• Collaborate with IT, Product Security, IAM, Legal, Procurement, Privacy, and business teams.

Skills

Risk management

Incident response

Governance

Stakeholder management

Fluent Italian

Fluent English

Education

CISSP or CISM certification desirable

Job description

Cybersecurity Governance, Risk & Compliance (GRC) Consultant

• Contract

An enterprise technology client is seeking an experienced Information Security Professional to support the protection of COET srl’s information systems and data from cybersecurity threats.

The selected consultant will work closely with the company's Cybersecurity team to identify, assess, monitor, and report cybersecurity risks across the COET organization.

This is a temporary, part-time consulting opportunity based in Italy

This opportunity is ideal for an experienced Information Security professional with knowledge of cybersecurity governance, risk management, compliance, and incident response.

What You’ll Do:

• Conduct cybersecurity risk assessments for COET srl.
• Analyze threats, vulnerabilities, control effectiveness, and residual risks.
• Maintain and update cybersecurity risk registers.
• Track risk mitigation and remediation activities through completion.
• Recommend ways to improve the efficiency, consistency, and effectiveness of Information Security operations.
• Develop and monitor cybersecurity policies, standards, and control requirements.
• Review risk assessments, mitigation plans, exceptions, and risk acceptance requests.
• Support cybersecurity governance forums and reporting activities.
• Assist with internal and external cybersecurity audits.
• Coordinate evidence collection and remediation tracking.
• Assess compliance with company's Energy cybersecurity standards and applicable country regulations, including NIS2.
• Support control assessments and gap analyses.
• Prepare materials for management and governance reviews.
• Escalate significant cybersecurity risks and emerging trends.
• Collaborate with IT, Product Security, IAM, Legal, Procurement, Privacy, and business teams.
• Provide guidance on cybersecurity risk management processes and requirements.
• Promote cybersecurity awareness and risk-informed decision-making.

Qualifications:

• Experience in Information Security governance, risk management, compliance, and incident response.
• Knowledge of common cybersecurity frameworks and regulations, such as NIST, NIS2, ISO 27001, and GDPR.
• CISSP, CISM, or an equivalent certification is desirable.
• Fluency in both Italian and English.
• Strong communication and stakeholder management skills.
• Ability to work independently and collaborate with cybersecurity and business teams.
• Cybersecurity risk assessments and updated risk registers.
• Risk mitigation and remediation tracking.
• Cybersecurity policies, standards, and control requirements.
• Audit evidence, control assessments, and gap analysis support.
• Governance review materials and cybersecurity reporting.

Location Requirement

• On-site presence at COET premises in San Donato Milanese, Italy, at least 3 times per month.

• Category: Information Security & Compliance
• Duration: September 14, 2026 to September 14, 2027
• The client is still evaluating the appropriate engagement structure. The selected talent may ultimately be engaged through an Employer of Record (EOR) arrangement rather than as an Independent Contractor.
• Candidates should be comfortable proceeding under either engagement structure. If EOR is selected, additional onboarding requirements and timelines may apply before the engagement begins.