Senior Cyber Risk and Assurance Specialist

Pepco Iberia; Porto; Hybrid; EUR 85,000 - 110,000; Full time

Benefits offered by this job

Hybrid work model

Porto office location

Competitive salary and annual bonus

Health insurance from month after join

Meal allowance

Employee discount in Pepco stores in (

Learning and development opportunities

International exposure across markets

Collaborative, down-to-earth culture

Job summary

Pepco Iberia is expanding its Tech Hub in Porto and seeks a Senior Cyber Risk & Assurance Specialist. You will strengthen governance, risk management, and compliance across the organization, collaborating with business and tech teams to lead risk activities and drive improvements.

You will manage audits, supplier security assessments, and assurance testing, working in a hybrid model with strong stakeholder engagement and multilingual capabilities valued.

Qualifications

• Bachelor’s or Master’s in Cybersecurity, Information Security, IT, Risk Management or related field.
• Experience in cyber risk assessments and regulatory compliance activities.
• Knowledge of ISO 27005, NIST RMF, and enterprise risk management.

Responsibilities

• Conduct cyber risk assessments across business and tech areas, identify vulnerabilities, and recommend mitigations.
• Facilitate risk assessments and workshops with guidance on risk treatment decisions.
• Develop risk reports, dashboards, and insights for informed business decisions.
• Support information security policies, standards, and governance frameworks.
• Coordinate audits, assess controls, and monitor remediation activities.
• Conduct third‑party security assessments and vendor risk evaluations.
• Support security awareness initiatives and phishing simulations.
• Collaborate with Security Architecture, Security Ops, Internal Audit, Procurement, Legal and Privacy teams.

Skills

Cyber risk assessments

Risk governance

Compliance & audits

Regulatory standards

Vendor security assessments

Stakeholder management

Data analysis & reporting

English fluency

Education

Bachelor’s or Master’s degree in Cybersecurity or related

CRISC/CISA/CISM or ISO 27001 Lead Auditor/Implementer/PCI Professional

Job description

About The Role

At Pepco, we’re growing fast and building our Tech Hub in Porto to support our business across Europe.

Build. Test. Deliver. Enjoy at Pepco!

At Pepco, we’re growing fast and building our Tech Hub in Porto to support our business across Europe.

We are looking for a Senior Cyber Risk & Assurance Specialist to join our team. In this role, you will help strengthen our cybersecurity governance, risk management, compliance, and assurance practices, ensuring that security risks are effectively identified, assessed, and managed across the organisation. Working closely with business and technology teams, you will lead cyber risk and assurance activities, support regulatory compliance, and drive continuous improvement in our security processes.

If you like things simple, practical and with real ownership, you’ll fit right in.

What You’ll Be Doing

• Conduct complex cyber risk assessments across business and technology areas, identifying vulnerabilities, evaluating risks, and recommending mitigation strategies.
• Facilitate risk assessments and workshops, providing expert guidance on risk treatment and acceptance decisions.
• Develop risk reports, dashboards, and insights to support informed business decisions.
• Support the development and continuous improvement of information security policies, standards, and governance frameworks.
• Manage compliance activities related to ISO 27001, NIS2, PCI-DSS, GDPR, and other applicable requirements.
• Coordinate internal and external audits, assess security controls, and monitor remediation activities.
• Conduct third-party security assessments, evaluating supplier risks, security controls, and compliance documentation.
• Participate in security assurance testing, control validation, and cyber resilience exercises.
• Support security awareness initiatives, including training programmes and phishing simulations.
• Collaborate with Security Architecture, Security Operations, Internal Audit, Procurement, Legal, Privacy, and other business teams.
• Act as a senior subject matter expert, sharing knowledge with colleagues, taking ownership of specific risk and assurance areas, and supporting the Cyber Risk & Assurance Lead when needed.

What We’re Looking For

• Bachelor’s or Master’s degree in Cybersecurity, Information Security, IT, Risk Management, Business Administration, or a related field. Certifications such as CRISC, CISA, CISM, ISO 27001 Lead Auditor/Implementer, or PCI Professional (PCIP) are a plus.
• At least 7 years of experience in cybersecurity, risk management, governance, compliance, audit, or assurance.
• Proven experience conducting cyber risk assessments, evaluating security controls, and supporting compliance activities. Experience in third-party risk management or vendor security assessments is an advantage.
• Strong knowledge of cybersecurity governance and risk management frameworks, including ISO 27005, NIST RMF, and enterprise risk management principles.
• Good understanding of information security frameworks and standards, such as ISO 27001, NIST CSF, and CIS Controls.
• Knowledge of regulatory requirements, including NIS2, GDPR, and PCI-DSS, and their practical application.
• Experience supporting internal and external audits, regulatory assessments, or certification processes.
• Ability to analyse technical and organisational risks and translate findings into practical business recommendations.
• Experience with reporting, dashboards, and data analysis tools.
• Strong analytical thinking, attention to detail, and the ability to manage multiple priorities independently.
• Excellent communication and stakeholder management skills, with the ability to work effectively with both technical and non-technical teams. Previous experience in multinational, complex, or regulated environments is a plus.
• Fluent English, both written and spoken. Additional languages are an advantage.

What We Offer

• Hybrid model:2 days remote / 3 days onsite
• Office based in Porto: https://maps.app.goo.gl/Nn7hc6uYrmPiT8Fc9
• Competitive salary and annual bonus
• Health insurance from the month after joining
• Meal allowance
• Employee discount in Pepco stores in Portugal
• Learning and development opportunities
• International exposure and collaboration across markets
• A simple, down-to-earth culture where people support each other

About Pepco

Pepco is one of Europe’s fastest-growing retail companies, with thousands of stores and millions of customers visiting us every month. Behind that growth, there’s a team of people who make things happen. We keep things simple, we focus on results, and we support each other to get there. At Pepco, no two days are the same. And that’s exactly how we like it.