GRC Consultant: Risk, Compliance & Governance Italy

Lifted, an Upwork Company™; San Donato Milanese; On-site; EUR 42,000 - 60,000; Part time

Job summary

Lifted, an Upwork Company™, seeks an Information Security professional to support COET srl in governance, risk, and compliance. The role focuses on identifying, assessing, monitoring, and reporting cybersecurity risks across the organization, including incident response and policy development.

The contractor will work with the Cybersecurity team to ensure conformity with NIS2, ISO27001, GDPR, and other regulatory requirements.

Qualifications

• Experience in Information Security governance, risk management, compliance, and incident response.
• Knowledge of frameworks/regulations: NIST, NIS2, ISO 27001, GDPR.
• Fluency in Italian and English is required.
• Strong communication and stakeholder management skills.
• Ability to work independently and collaborate with cybersecurity and business teams.

Responsibilities

• Conduct cybersecurity risk assessments for COET srl.
• Analyze threats, vulnerabilities, control effectiveness, and residual risks.
• Maintain and update cybersecurity risk registers.
• Track risk mitigation and remediation activities through completion.
• Develop and monitor cybersecurity policies, standards, and control requirements.
• Assist with internal and external cybersecurity audits.
• Coordinate evidence collection and remediation tracking.
• Prepare materials for management and governance reviews.
• Escalate significant cybersecurity risks and emerging trends.
• Collaborate with IT, Product Security, IAM, Legal, Procurement, Privacy, and business teams.

Skills

Risk management

Incident response

Governance

Stakeholder management

Fluent Italian

Fluent English

Education

CISSP or CISM certification desirable

Job description

Lifted, an Upwork Company™, seeks an Information Security professional to support COET srl in governance, risk, and compliance. The role focuses on identifying, assessing, monitoring, and reporting cybersecurity risks across the organization, including incident response and policy development.

The contractor will work with the Cybersecurity team to ensure conformity with NIS2, ISO27001, GDPR, and other regulatory requirements.