Senior GRC & Audit Lead — ISO/SOC Excellence

Duco; Wrocław; Hybrid; PLN 180,000 - 260,000; Full time

Benefits offered by this job

Annual bonus

Private Medical Insurance - Inter Поль

Life Insurance

Multisport Program

Unlimited annual holiday

Home working allowance

Referral program

Job summary

Duco in Wroclaw, Poland, seeks a Senior GRC Analyst to support the Security GRC Manager in preparing and executing external audits (ISO 27001, SOC 1, SOC 2) and to own the Enterprise Risk Management framework during the initial phase. You will collaborate with the Information Security team, auditors and control owners to evidence operating effectiveness and manage risk.

You will work closely with Legal, Engineering and the Executive Leadership Team, shaping the future direction of Information

Qualifications

• Minimum of five years of experience in Information Security or a comparable role.
• Hands-on experience supporting external audits (ISO 27001, SOC 1 and/or SOC 2 Type II).
• Experience managing technology risk and information security programs.
• Ability to translate technical findings into clear business impact.

Responsibilities

• Own the enterprise risk register and risk appetite framework during the initial phase.
• Support ISO 27001, SOC 1 and SOC 2 audits with evidence collection and control testing.
• Maintain and monitor risk management lifecycle and risk reporting to the Risk Committee.
• Assist in AI governance and develop practical standards for responsible AI.

Skills

Information security

Audit readiness

Risk assessment

Stakeholder management

English proficiency

Security risk reporting

Communication skills

Regulatory understanding

Education

ISO 27001 Lead Auditor / Lead Implementer

CISA or CRISC certification

Tools

Jira

Confluence

Claude

Rovo

Job description

Duco in Wroclaw, Poland, seeks a Senior GRC Analyst to support the Security GRC Manager in preparing and executing external audits (ISO 27001, SOC 1, SOC 2) and to own the Enterprise Risk Management framework during the initial phase. You will collaborate with the Information Security team, auditors and control owners to evidence operating effectiveness and manage risk.

You will work closely with Legal, Engineering and the Executive Leadership Team, shaping the future direction of Information