Senior GRC & Audit Analyst

Duco; Polska; Hybrid; PLN 180,000 - 280,000; Full time

Benefits offered by this job

Private Medical Insurance - Inter Поль

Life Insurance

Multisport Program

Unlimited annual holiday

Job summary

Duco is seeking a Senior GRC Analyst to support the Security GRC Manager in audit execution for ISO 27001, SOC 1 and SOC 2, while initially owning the Enterprise Risk Management Framework. You’ll collaborate with Information Security, auditors, and control owners to ensure effective controls evidence and risk reporting to the Risk Committee.

You will work closely with Security, Legal, Engineering and the Exec Leadership Team to shape Duco’s information security strategy and governance, while

Qualifications

• A minimum of five years’ experience in Information Security or a comparable role.
• Hands-on experience supporting external audits (ISO 27001, SOC 1 and/or SOC 2 Type II).
• Knowledge of technology risk management and information security controls.
• Ability to translate technical findings into clear business impact.
• Experience with ISMS and maintaining security accreditations.

Responsibilities

• Own the enterprise risk register and risk appetite framework.
• Conduct Information Security risk assessments across the tech estate.
• Present risk reporting to the Executive Leadership Team at Risk Committee.
• Support audit readiness and evidence collection for ISO 27001, SOC 1/2.

Skills

Information Security

External audits

Risk management

ISMS

English proficiency

Communication

Audit readiness

Regulatory alignment

Education

ISO 27001 Lead Auditor

CISA

CRISC

Tools

Jira

Confluence

Claude

Rovo

Job description

Duco is seeking a Senior GRC Analyst to support the Security GRC Manager in audit execution for ISO 27001, SOC 1 and SOC 2, while initially owning the Enterprise Risk Management Framework. You’ll collaborate with Information Security, auditors, and control owners to ensure effective controls evidence and risk reporting to the Risk Committee.

You will work closely with Security, Legal, Engineering and the Exec Leadership Team to shape Duco’s information security strategy and governance, while