GRC Information Security Specialist — ISO27001 & Risk Controls

DS Smith Europe; Kraków; On-site; PLN 150,000 - 210,000; Full time

Job summary

DS Smith Europe seeks an information security and GRC professional to support certification and compliance efforts, collaborate with IT leadership, and manage security controls and risk processes. The role includes engaging with customers and suppliers to meet assurance requirements and may involve on-site visits.

Candidates should have strong knowledge of ISO27001, NIST CSF, and related frameworks, with fluency in English and the ability to communicate complex security concepts to non-IT

Qualifications

• Good working knowledge of recognised information and cybersecurity domains, and standards such as the NIST CSF, ISO27001 or similar.
• Experience delivering and working within frameworks such as ISO27001, NIST CSF or similar.
• Experience in information security controls design, documentation, assessment or assurance.
• Experience with information security customer questionnaires and third-party risk management.
• Ability to communicate IT/information security concepts to non-IT stakeholders.

Responsibilities

• Support creation of information and cybersecurity documentation in support of certification and regulatory compliance (e.g., ISO27001 and EU NIS2).
• Own or support information security controls operated by I&T GRC, including risk process management and awareness in collaboration with the team.
• Respond to customer security assurance requirements and supplier assurance schedules.

Skills

GRC knowledge

ISO27001/NIST CSF

English fluency

Stakeholder communication

Information security concepts

Analytical skills

Education

Relevant qualification in Computer Science or Information Security

Tools

GRC platforms

Microsoft tooling

Job description

DS Smith Europe seeks an information security and GRC professional to support certification and compliance efforts, collaborate with IT leadership, and manage security controls and risk processes. The role includes engaging with customers and suppliers to meet assurance requirements and may involve on-site visits.

Candidates should have strong knowledge of ISO27001, NIST CSF, and related frameworks, with fluency in English and the ability to communicate complex security concepts to non-IT