Head of IT Compliance & Security (ISO 27001/SOC 2)

DOU Polska; Wrocław; On-site; PLN 180,000 - 240,000; Full time

Benefits offered by this job

Private medical cover

Annual leave (20 or 26 days)

Learning Hub

Gym membership

Multisport membership

Job summary

ARRISE is seeking an experienced IT Compliance Specialist to lead ISO 27001 and SOC 2 programs, coordinating internal and external audits, risk assessments, and remediation efforts across cloud hosting and APIs. The role requires strong documentation, policy governance, and collaboration with cross-functional teams.

You will respond to client security questionnaires, ensure controls align with evolving scope changes, and train teams on secure software development and industry standards.

Qualifications

• Bachelor's degree in information security, CS, risk management or related field.
• 5+ years’ experience in IT compliance, GRC, risk management, or information security in regulated industries.
• Strong understanding of ISO 27001:2022 ISMS and SOC 2 Trust Services Criteria.
• Proven track record leading certification and audit processes.

Responsibilities

• Lead ISO 27001 ISMS and SOC 2 programs; coordination with auditors.
• Own audits: plan, gather evidence, provide responses.
• Manage risk assessments, testing, remediation; ensure ongoing compliance.
• Respond to client security questionnaires with detailed information.
• Oversee access control, change management, incident management, and vendor risk.
• Develop and enforce security/compliance policies and standards.

Skills

ISO 27001

SOC 2

Audits

Security questionnaires

Cloud/SaaS/APIs

Secure SDLC/DevOps

Stakeholder management

Communication

Analytical thinking

Cross-functional collaboration

Education

Bachelor's degree in information security

Bachelor's degree in Computer Science

Bachelor's degree in Risk Management

Job description

ARRISE is seeking an experienced IT Compliance Specialist to lead ISO 27001 and SOC 2 programs, coordinating internal and external audits, risk assessments, and remediation efforts across cloud hosting and APIs. The role requires strong documentation, policy governance, and collaboration with cross-functional teams.

You will respond to client security questionnaires, ensure controls align with evolving scope changes, and train teams on secure software development and industry standards.