Compliance Officer

Savangard; Województwo mazowieckie; Vor Ort; PLN 180.000 - 300.000; Vollzeit

Zusammenfassung

Savangard seeks an experienced IT Regulatory Compliance Officer to lead the regulatory program for Savangard and its clients. You will translate complex requirements into practical actions, work with executives, and guide technical teams through compliance initiatives.

Key focus areas include DORA, NIS2/KSC, ISO 27001, AI and Data acts, and third-party risk management. Excellent Polish and English communication are essential.

Qualifikationen

• 5+ years of experience in compliance, GRC, IT audit, or information security with hands-on DORA and NIS2/KSC requirements.
• Degree in Law and ability to independently prepare compliance documentation, policies and processes.
• In-depth knowledge of DORA RTS/ITS and third-party ICT service provider requirements.
• Experience implementing ISO/IEC 27001 ISMS and supporting audits.

Aufgaben

• Build, develop, and maintain the regulatory compliance function across Savangard and PeopleVibe.
• Ensure compliance with KSC/NIS2, DORA, ISO 27001, AI Act, Data Act, and other cybersecurity regulations.
• Translate regulatory requirements into practical controls, procedures, and contracts.
• Collaborate with clients, especially in finance, on regulatory and ICT security requirements.
• Prepare for audits, inspections, and compliance assessments; monitor regulatory changes.
• Provide executive reporting on compliance status and risks; coordinate with Digia Group compliance.
• Conduct investigations into irregularities and liaise with authorities; deliver training on compliance and information security.
• Oversee incident management, risk management, and vendor/subcontractor compliance; support business and sales teams.

Kenntnisse

Regulatory compliance

GRC experience

IT audit

Polish (C1)

English (C1)

Vendor risk management

Contract controls

Ausbildung

Law degree

Tools

ISO 27001 Lead Implementer

CISA

CISM

CRISC

DORA-related certs

Jobbeschreibung

We are a software house made up of highly skilled and talented professionals who are ready to fully commit to every project and always go the extra mile. System integration, business process automation, and application development are our core areas of expertise, and what truly sets us apart from the competition. We support one another in the face of challenges and continuously learn new things to deliver the best possible solutions to our clients. Trust, integrity, and autonomy are the values that have enabled us to build and grow our company for more than 20 years. Join us and help shape our future!

We are looking for an experiencedIT Regulatory Compliance Officer who will support both our organization and our clients in successfully navigating an increasingly complex regulatory landscape. If you have a strong understanding of regulatory requirements and can translate them into practical business and organizational actions, thrive in collaborating with executive leadership, clients, and technical teams, and have a keen interest in cybersecurity and emerging technologies, we would be delighted to meet you.

More specifically, you will be responsible for:

building, developing, and maintaining the regulatory compliance function across Savangard and PeopleVibe, including the preparation, implementation, regular review, and update of policies and procedures,

ensuring the organization’s compliance with the requirements of KSC/NIS2, DORA, ISO 27001, the AI Act, the Data Act, and other regulations related to cybersecurity and emerging technologies,

analyzing new regulatory requirements and translating them into practical processes, procedures, and business activities,

collaborating with clients, particularly in the financial sector, on regulatory and ICT security requirements, including completing security and compliance questionnaires,

preparing the organization for audits, inspections, and compliance assessments,

monitoring regulatory changes and recommending appropriate remediation and adaptation measures,

preparing reports for executive management and collaborating with the Digia Group’s compliance function, including ongoing reporting on compliance status and risks to the Management Board,

conducting investigations related to reported irregularities and compliance breaches, and liaising with regulatory authorities in supervisory proceedings,

delivering training sessions and initiatives that foster a culture of compliance and information security,

overseeing incident management, risk management, and vendor/subcontractor compliance processes,

supporting business, technical, and sales teams on compliance-related matters.

We would like to hear from you if you have:

• At least 5 years of experience in compliance, GRC, IT audit, or information security, including hands-on experience working with DORA and NIS2/KSC requirements.
• A degree in Law.
• Strong knowledge of regulatory and industry-specific requirements, with the ability to independently prepare compliance documentation, policies, and processes, and successfully implement them within an organization.
• In-depth knowledge of the DORA Regulation and its implementing standards (RTS/ITS), particularly regarding third-party ICT service providers and contractual requirements.
• Practical experience with the amended National Cybersecurity System Act (KSC), including preparing and implementing documentation, processes, and policies; knowledge of entity classification, ISMS requirements, incident reporting and handling; and supporting management in fulfilling its regulatory obligations.
• Experience with an ISO/IEC 27001-compliant Information Security Management System (ISMS), including implementation, maintenance, or auditing activities.
• The ability to translate regulatory requirements into practical controls, procedures, contractual clauses, and compliance evidence.
• Experience in third-party/vendor risk management and negotiating security-related contractual provisions.
• Excellent command of Polish and English (minimum C1 level).

Nice to have

• Experience working for an ICT service provider supporting banks, or within a bank in the area of ICT vendor management.
• Knowledge of Polish Financial Supervision Authority (KNF) requirements, including Recommendation D, outsourcing, and cloud computing regulations, as well as experience with KNF inspections or audits.
• Certifications such as ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, CISA, CISM, CRISC, CIPP/E, or DORA-related certifications.
• Experience gained in a law firm specializing in technology and emerging technologies.
• Knowledge of the Cyber Resilience Act (CRA) and software development lifecycle practices, including vulnerability management and SBOM.
• Experience working within an international corporate group or supporting post-acquisition integration initiatives.
• Strong self-reliance and the ability to build and develop a compliance function from the ground up.
• Excellent communication skills, with the ability to engage effectively with executive leadership, engineers, and clients at the appropriate level of detail.
• Resilience and the ability to work under pressure, particularly in the context of regulatory deadlines, incident reporting requirements, and client audits.

Rekrutacja

1

2

3