Compliance Officer

Savangard; Warszawa; Hybrid; PLN 180,000 - 280,000; Full time

Benefits offered by this job

MultiSport card

Mental health support

Private healthcare

Employee referral program

English lessons

Audiobooks access

Snacks and coffee

Team-building events

Savangard culture initiatives

Job summary

Savangard is seeking an experienced IT Regulatory Compliance Officer to help navigate a complex regulatory landscape. You will translate requirements into practical controls, collaborate with leadership, clients, and technical teams, and promote a culture of compliance and information security.

You will build and maintain policies, prepare for audits, manage third‑party risk, and report on compliance status to the Management Board, while supporting Digia Group's compliance function.

Qualifications

• Experience with regulatory frameworks including DORA and NIS2/KSC and ability to translate them into practical controls.
• Ability to independently prepare compliance documentation, policies, and processes and implement them in an organization.
• Experience in ISO/IEC 27001 ISMS implementation, maintenance, or auditing.

Responsibilities

• Build, develop, and maintain the regulatory compliance function across Savangard and PeopleVibe.
• Ensure compliance with KSC/NIS2, DORA, ISO 27001, AI Act, Data Act, and related cybersecurity regs.
• Translate regulatory requirements into practical processes, procedures, and business activities.
• Collaborate with clients, especially in finance, on regulatory and ICT security requirements.
• Prepare the organization for audits, inspections, and compliance assessments.
• Monitor regulatory changes and recommend remediation measures.
• Report compliance status and risks to Management Board and Digia Group's function.
• Conduct investigations and liaise with regulators on supervisory matters.
• Deliver training to foster compliance and information security culture.
• Oversee incident, risk, and vendor/subcontractor compliance processes.
• Support business, technical, and sales in compliance matters.

Skills

Regulatory compliance

GRC

IT audit

Information security

DORA/NIS2/KSC

ISO 27001/ISMS

Vendor risk mgmt

English (C1)

Polish (C1)

Education

Law degree

Job description

We are a software house made up of highly skilled and talented professionals who are ready to fully commit to every project and always go the extra mile. System integration, business process automation, and application development are our core areas of expertise, and what truly sets us apart from the competition. We support one another in the face of challenges and continuously learn new things to deliver the best possible solutions to our clients. Trust, integrity, and autonomy are the values that have enabled us to build and grow our company for more than 20 years. Join us and help shape our future!

We are looking for an experiencedIT Regulatory Compliance Officer who will support both our organization and our clients in successfully navigating an increasingly complex regulatory landscape. If you have a strong understanding of regulatory requirements and can translate them into practical business and organizational actions, thrive in collaborating with executive leadership, clients, and technical teams, and have a keen interest in cybersecurity and emerging technologies, we would be delighted to meet you.

More specifically, you will be responsible for:

building, developing, and maintaining the regulatory compliance function across Savangard and PeopleVibe, including the preparation, implementation, regular review, and update of policies and procedures,

ensuring the organization's compliance with the requirements of KSC/NIS2, DORA, ISO 27001, the AI Act, the Data Act, and other regulations related to cybersecurity and emerging technologies,

analyzing new regulatory requirements and translating them into practical processes, procedures, and business activities,

collaborating with clients, particularly in the financial sector, on regulatory and ICT security requirements, including completing security and compliance questionnaires,

preparing the organization for audits, inspections, and compliance assessments,

monitoring regulatory changes and recommending appropriate remediation and adaptation measures,

preparing reports for executive management and collaborating with the Digia Group's compliance function, including ongoing reporting on compliance status and risks to the Management Board,

conducting investigations related to reported irregularities and compliance breaches, and liaising with regulatory authorities in supervisory proceedings,

delivering training sessions and initiatives that foster a culture of compliance and information security,

overseeing incident management, risk management, and vendor/subcontractor compliance processes,

supporting business, technical, and sales teams on compliance-related matters.

We would like to hear from you if you have:

• At least 5 years of experience in compliance, GRC, IT audit, or information security, including hands-on experience working with DORA and NIS2/KSC requirements.
• A degree in Law.
• Strong knowledge of regulatory and industry-specific requirements, with the ability to independently prepare compliance documentation, policies, and processes, and successfully implement them within an organization.
• In-depth knowledge of the DORA Regulation and its implementing standards (RTS/ITS), particularly regarding third-party ICT service providers and contractual requirements.
• Practical experience with the amended National Cybersecurity System Act (KSC), including preparing and implementing documentation, processes, and policies; knowledge of entity classification, ISMS requirements, incident reporting and handling; and supporting management in fulfilling its regulatory obligations.
• Experience with an ISO/IEC 27001-compliant Information Security Management System (ISMS), including implementation, maintenance, or auditing activities.
• The ability to translate regulatory requirements into practical controls, procedures, contractual clauses, and compliance evidence.
• Experience in third-party/vendor risk management and negotiating security-related contractual provisions.
• Excellent command of Polish and English (minimum C1 level).

Nice to have

• Experience working for an ICT service provider supporting banks, or within a bank in the area of ICT vendor management.
• Knowledge of Polish Financial Supervision Authority (KNF) requirements, including Recommendation D, outsourcing, and cloud computing regulations, as well as experience with KNF inspections or audits.
• Certifications such as ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, CISA, CISM, CRISC, CIPP/E, or DORA-related certifications.
• Experience gained in a law firm specializing in technology and emerging technologies.
• Knowledge of the Cyber Resilience Act (CRA) and software development lifecycle practices, including vulnerability management and SBOM.
• Experience working within an international corporate group or supporting post-acquisition integration initiatives.
• Strong self-reliance and the ability to build and develop a compliance function from the ground up.
• Excellent communication skills, with the ability to engage effectively with executive leadership, engineers, and clients at the appropriate level of detail.
• Resilience and the ability to work under pressure, particularly in the context of regulatory deadlines, incident reporting requirements, and client audits.

What we offer

MultiSport sports card – we cover 80% of the cost.

Mental health support – confidential access to consultations through

Wellbee.Private healthcare – package for you and your family members.

Employee referral program – attractive bonuses for recommending candidates.

English language lessons – classes with a native speaker and access to the SuperMemo learning platform.

Unlimited access to audiobooks – completely free of charge.

Fresh fruit, snacks, and great coffee – available in the office every day.

#turlanie – regular board game evenings organized by our employees.

Team-building events throughout the year – including our Easter gathering, Savangarden Party, Savangard Off-Site, and Savangard X-Mas celebrations.

1. Initial Interview (30 min, online)
The first stage is a brief meeting with a recruiter, during which we will discuss your professional experience, motivation for considering a new opportunity, and mutual expectations. We will also go over the terms of cooperation and answer any questions you may have.

2. Technical/Professional Interview (60 min)
At this stage, we focus on assessing your regulatory knowledge and practical experience. We will discuss the projects you have worked on, your way of working, and your approach to problem-solving.

3. Interview with the Management Board (45 min, on-site)
The final stage is a meeting with representatives of the Management Board, during which we will discuss mutual expectations, your fit with the organization, and potential future cooperation.