Senior Governance Risk and Compliance Expert

QNR Group; Warszawa; Hybrid; PLN 180,000 - 240,000; Full time

Job summary

QnR Group in Warsaw, Poland, seeks a Senior Governance, Risk and Compliance Expert to join a public sector client. You will ensure IT operations align with EU data protection laws, conduct DPIAs and RoPAs, and advise stakeholders on obligations, while working remotely from Poland.

You will lead data privacy policy development, deliver awareness training, and collaborate with authorities and cross-functional teams on information security and third-party governance.

Qualifications

• 5+ years IT experience and 4+ years in a GRC role
• Master’s degree in Computer Science, Engineering or related field
• Hands-on data protection compliance in ICT/public sector
• Experience with RoPAs, DPIAs, DPAs, and data mapping
• Knowledge of EU data protection laws and standards

Responsibilities

• Ensure IT operations comply with data privacy laws, regulations and standards
• Conduct privacy impact assessments (DPIAs) and maintain RoPAs
• Identify compliance gaps and propose practical countermeasures
• Advise on data protection matters across the organisation
• Develop and communicate data privacy policies and procedures
• Deliver staff awareness training on data protection
• Act as the contact for queries and complaints related to data processing
• Cooperate with authorities and professional groups on data protection matters
• Manage legal aspects of information security and third-party relations

Skills

GRC experience

Data privacy

Policy development

Training delivery

Communication

Education

Master’s degree in Computer Science/Engineering

Tools

SIEM

Job description

Are you a Senior GRC Expert? Think bigger about your next move!

Build your future with QnR Group.

Senior Governance Risk and Compliance Expert | Quality & Reliability (QnR), the parent company of QnR Group

Role overview

We are looking for aSenior Governance Risk and Compliance Expertto join one of our Public sector clients based in Warsaw, Poland, working remotely. You will ensuring that IT operations align with EU data protection legislation, conducting privacy impact assessments, maintaining records of processing activities and advising stakeholders across the organisation on their obligations.

About QnR Group

QnR Groupis a technology group with 35 years of experience, 8 companies, 4 delivery centers and 210+ professionals across Greece, Belgium, Cyprus and Poland. Listed on the Athens Stock Exchange since 2000, we deliver mission-critical digital transformation projects for the public and private sector. The Group’s capabilities coverssoftware engineering, enterprise and generative AI, cybersecurity, cloud infrastructure, SAP and ServiceNow solutions, core banking and maritime intelligence.

What you'll work on:

• Ensuring IT operations comply with data privacy laws, regulations and standards
• Conducting privacy impact assessments (DPIAs) and maintaining records of processing activities (RoPAs)
• Identifying compliance gaps and proposing practical countermeasures
• Advising on data protection matters, particularly around personal data processing
• Developing, maintaining and communicating data privacy policies and procedures
• Delivering staff awareness training to foster a culture of data protection
• Acting as the contact point for queries and complaints related to data processing
• Cooperating with authorities and professional groups on data protection matters
• Managing legal aspects of information security and third-party relations

What you bring:

• At least5+ yearsof IT experience and4+ yearsin a GRC role
• Master’s degree in Computer Science, Engineering or a related technical field
• Hands‑on data protection compliance experience in an ICT, EU institutional, or public-sector environment
• Experience in preparing or reviewing RoPAs, DPIAs, Data Processing Agreements, and Transfer Impact Assessments, including data mapping and input validation from technical owners
• Experience in documenting technical arrangements relevant to data protection: access rights, privileged access, logs/SIEM exports, retention, data flows, processors and subprocessors
• Deep knowledge of EU data protection legislation, regulatory frameworks, and privacy standards
• Ability to work with incomplete or inconsistent ICT information, distinguishing facts from assumptions, identifying gaps and structuring clear follow-up
• Strong communication skills, able to explain data protection topics to both technical and non-technical audiences
• English C1 level certification

Certifications you'll need:

At least 3 certificationsfrom the following:

• CISA — Certified Information Systems Auditor
• CISM — Certified Information Security Manager
• GSNA — GIAC Systems and Network Auditor
• GCCC — GIAC Critical Controls
• ISO 27001 Lead Implementer
• ISO 27001 Lead Auditor
• ISO 27005 Risk Manager
• CAP — (ISC)² Certified Authorization Professional
• CRISC — ISACA Certified in Risk and Information Systems Control
• CISSP-ISSMP — (ISC)² Information Systems Security Management Professional
• GIAC Certified ISO-27000 Specialist
• or internationally recognised equivalent (subject to EU-I acceptance)

Nice to have

• Prior experience in an EU institutional environment.
• Familiarity with the practical implications of evolving EU legal frameworks on organisational data protection strategy.
• Experience collaborating across multidisciplinary teams including cybersecurity, SOC, and architecture functions.