InfoSec Governance & Risk Specialist (Hybrid)

OANDA; Warszawa; Hybrid; PLN 120,000 - 190,000; Full time

Job summary

OANDA is hiring an Information Security professional to help govern and strengthen our cyber risk program. You will collect cybersecurity requirements, monitor controls, and conduct third-party security due diligence to mitigate risks across teams.

You will participate in policy reviews, control testing, and documentation updates to ensure audit readiness. The role supports training materials and regulatory responses, in a hybrid Warsaw-based setup.

Qualifications

• 2+ years in Information Security, Risk Management, or GRC, with practical impact.
• Solid knowledge of major security frameworks (ISO27001, NIST, SOC2, PCI-DSS).
• Understanding GDPR, DORA, and financial sector standards.
• Hands-on experience with policy reviews, risk tracking, or control testing.
• Strong analytical and communication skills with a proactive mindset.

Responsibilities

• Collect and analyze cybersecurity requirements for GDPR, DORA, ISO27001 and financial regulations.
• Monitor controls, KRIs, and KPIs; track cyber risks and support remediation efforts.
• Perform third-party security due diligence, vendor assessments, security questionnaires, and contract reviews.
• Help with control testing, policy reviews, and documentation for the security program.
• Assist in creating training materials to counter malware, phishing, and physical threats.
• Support evidence gathering for audits and respond to regulatory questionnaires.

Skills

Information Security

Risk Management

GRC

Policy Review

Compliance

Tools

Vanta

Job description

OANDA is hiring an Information Security professional to help govern and strengthen our cyber risk program. You will collect cybersecurity requirements, monitor controls, and conduct third-party security due diligence to mitigate risks across teams.

You will participate in policy reviews, control testing, and documentation updates to ensure audit readiness. The role supports training materials and regulatory responses, in a hybrid Warsaw-based setup.