Information Security & Compliance Consultant

Roboyo; Porto; On-site; EUR 60,000 - 90,000; Full time

Job summary

Roboyo Porto is seeking an Information Security & Compliance Consultant to manage client projects focused on information security, cybersecurity, data protection and regulatory compliance. The role involves ISO/IEC 27001 ISMS delivery and ongoing improvement, with emphasis on regulatory frameworks including NIS2, DORA and GDPR.

The consultant will own a portfolio of clients, support certification processes, coordinate audits, and contribute to governance, risk management, and supplier security

Qualifications

• ISO/IEC 27001 ISMS implementation experience.
• Knowledge of ISO/IEC 27001:2022 requirements.
• Experience with NIS2 regulatory governance.
• GDPR/data protection principles understanding.
• DORA ICT risk/compliance knowledge.
• Experience preparing for internal, certification or surveillance audits.

Responsibilities

• Lead ISO/IEC 27001 ISMS implementation, maintenance and improvement for clients.
• Perform ISO 27001 gap and readiness assessments throughout certification cycles.
• Assist organisations with NIS2 governance and cybersecurity measures.
• Support DORA compliance incl. ICT risk management and resilience.
• Provide GDPR/data protection advisory services and risk assessments.
• Develop policies, risk registers and evidence for compliance.
• Coordinate ISO 27001 audits with customers, auditors and partners.
• Engage with customers to identify risks and remediation plans.
• Contribute to commercial activities and proposal preparation.

Skills

Customer-facing

Stakeholder management

Regulatory awareness

Audit readiness

Education

Higher education in Information Security

Job description

Information Security & Compliance Consultant

Porto

RoboyoAIis a category shaper in Applied AI and Agentic Automation. We help leading enterprises move from automation projects and AI experiments into governed, production-grade systems that execute real work across workflows, processes,productsand services.

Our heritage is in scaled enterprise automation; our future isApplied AI andAgenticAutomation: autonomous agents, AI engineering squads, process orchestration, data and knowledge foundations, and human-in-the-loop governance embedded deeply into how our clientsoperate.

We are not here to sell AI theatre. We are here to turn AI intoworking systems, measurableoutcomesand repeatable transformation programs.

ABOUT THE ROLE

We are looking for an Information Security & Compliance Consultant to manage and deliver client projects in the areas of information security, cybersecurity, data protection and regulatory compliance.

The successful candidate will take ownership of a portfolio of clients and projects, supporting organisations in the implementation, maintenance and continuous improvement of ISO/IEC 27001 Information Security Management Systems (ISMS) and in their compliance with regulatory frameworks including NIS2, DORA and GDPR.

The role combines strong technical and regulatory knowledge with hands‑on consulting, audit preparation, risk management and client relationship management. The consultant will also contribute to the maintenance and continuous improvement of Roboyo's internal management systems.

MAIN RESPONSIBILITIES

Lead the implementation, maintenance and continuous improvement of ISO/IEC 27001 Information Security Management Systems (ISMS) for clients.

Perform ISO 27001 gap assessments, readiness assessments and support organisations throughout certification and surveillance audit processes

Support organisations in assessing and implementing requirements arising from NIS2, including governance, cybersecurity risk management measures, incident management, business continuity, supply‑chain security and compliance monitoring.

Support financial‑sector clients and ICT service providers with DORA compliance, including ICT risk management, incident management, operational resilience and ICT third‑party risk.

Provide GDPR/data protection advisory services, including privacy governance, risk assessments, policies, procedures and, where applicable, DPO services.

• Conduct and coordinate information security risk assessments, supporting the definition and monitoring of risk treatment plans.
• Develop, review and maintain information security and compliance documentation, including policies, procedures, risk registers, Statements of Applicability and supporting evidence.
• Coordinate and/or perform internal ISO 27001 audits and support external certification audits.
• Coordinate activities with certification bodies, auditors, customers and specialised cybersecurity providers.
• Support customers in establishing and improving third‑party/supplier security and due diligence processes.
• Support incident management, business continuity and information security governance activities.
• Identify compliance gaps and define pragmatic remediation plans with customers.
• Manage multiple customer engagements, including project planning, deliverables, service hours and agreed milestones.
• Participate in customer meetings, workshops, presentations and demonstrations of consulting services and compliance solutions.
• Contribute to commercial activities, including demos, explore meetings, scope definition, effort estimation and preparation of proposals for information security and compliance project

MANDATORY REQUIREMENTS

• Higher education in Information Security, Cybersecurity, Information Systems, Engineering, Management, Law or a related field.

Proven hands‑on experience implementing and/or maintaining ISO/IEC 27001 ISMS.

Practical knowledge of ISO/IEC 27001:2022 requirements and information security risk management.

Demonstrable knowledge and project experience related to NIS2 requirements and cybersecurity governance.

• Strong knowledge of GDPR and data protection principles.
• Knowledge of DORA and ICT risk/compliance requirements.
• Experience preparing organisations for internal, certification and/or surveillance audits.
• Ability to develop information security policies, procedures, risk assessments and compliance documentation.
• Strong customer‑facing and stakeholder‑management skills.
• Ability to manage multiple customers and projects independently.
• Good written and verbal communication skills in Portuguese and English.

CERTIFICATION

At least one of the following certifications, or equivalent recognised certification:

Candidates holding both Lead Implementer and Lead Auditor certifications will be strongly preferred.

VALUED REQUIREMENTS

Both ISO/IEC 27001 Lead Implementer and Lead Auditor certifications.

Additional information security or risk certifications.

Experience with ISO/IEC 27701 Privacy Information Management Systems.

Experience with other management system standards, particularly ISO 9001, ISO 22301, ISO 37001 or ISO 13485.

Experience with third‑party risk management, supplier assessments and due diligence.

Experience with business continuity, incident response and operational resilience.

Experience coordinating penetration testing, vulnerability assessments or other cybersecurity assurance activities with specialist providers.

Previous consulting experience and responsibility for managing a portfolio of customers.

Experience preparing commercial proposals and estimating information security/compliance projects.

BEHAVIOURAL PROFILE

Autonomous and accountable, able to take ownership of client engagements from assessment through implementation and audit.

Strong organisational skills and ability to manage multiple clients, priorities and deadlines simultaneously.

Analytical mindset with strong attention to detail.

Ability to translate complex regulatory and technical requirements into practical actions for customers.

Proactive approach to identifying risks, compliance gaps and improvement opportunities.

Strong written and verbal communication skills, particularly in customer-facing environments.

Comfortable facilitating workshops and interacting with management, technical teams, auditors and external partners.

Pragmatic and solution-oriented approach to compliance.

Strong team spirit and willingness to collaborate with internal and external specialists.

We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.