Senior Governance, Risk and Compliance Engineer

payabl.; Lisboa; Presencial; EUR 70 000 - 90 000; Tempo integral

Vantagens oferecidas por esta oferta de emprego

Provident Fund

Annual Learning Budget

€150 Wolt allowance

SportsBenefits membership

Company car after probation

Complimentary parking

25 days vacation + holidays + 10 sick

Local discount card

Greek language classes

Company-wide events

Global collaboration & events

Resumo da oferta

payabl. is seeking a Senior GRC Specialist to strengthen and mature its information security governance, risk and compliance function.

You will develop and operate frameworks, registers and processes for a regulated, multi-entity payments group across ISO 27001, DORA, GDPR and PCI DSS. This is a hands-on senior role with ownership: build and run programs, work with a modern GRC platform, and apply AI to automation of day-to-day GRC tasks.

Qualificações

• 3+ years of experience in GRC, information security governance, IT audit or IT risk management.
• Working knowledge of ISO/IEC 27001; exposure to DORA, GDPR or PCI DSS.
• Experience in regulated financial services or advisory work for such companies.
• Hands‑on audits experience coordinating them, preparing evidence, remediating findings.
• Familiarity with GRC platforms or a strong interest in compliance automation.
• Strong written English; output goes to auditors, regulators and senior stakeholders.

Responsabilidades

• Governance & Policy Management: develop and improve information security policies aligned with ISO 27001 and regulatory requirements.
• Operate the policy lifecycle: approval workflows, reviews, ownership and version control across documents.
• Risk Management: maintain risk register, assess and track remediation.
• Regulatory Compliance: support DORA, PSD2/EBA guidelines, GDPR and PCI DSS across entities.
• Audit & Assurance: coordinate audits and manage audit calendar; maintain evidence library.
• GRC Platform, AI & Automation: administer and develop the GRC platform; apply AI tooling to policy drafting, gap analysis and evidence assembly; contribute to AI governance programme.

Conhecimentos

GRC

Information Security

ISO 27001

Regulatory Compliance

Risk Management

English communication

Formação académica

CISA

CRISC

CISM

CIPP/E

ISO 27001 Lead Auditor

Ferramentas

Vanta

ServiceNow GRC

OneTrust

Descrição da oferta de emprego

The role is about:

We are looking for a Senior GRC Specialist to strengthen and mature our information security governance, risk and compliance function. Reporting to the Head of Information Security, you will develop and operate the frameworks, registers and processes that keep a regulated, multi-entity payments group compliant and audit-ready — across ISO 27001-aligned governance, DORA, GDPR, PCI DSS and operational resilience requirements.

This is a hands‑on senior role with real ownership: you will build programs as well as run them, work with a modern GRC platform, and apply AI and automation to how the work itself gets done.

• Location: Limassol, Cyprus or Remote from Poland or Portugal
• Reporting to: Head of Information Security

What will you do:

• Governance & Policy Management
• Develop, maintain and continuously improve information security policies, standards and procedures aligned with ISO 27001 and regulatory requirements
• Operate the policy lifecycle: approval workflows, periodic reviews, ownership and version control across the document estate
• Risk Management
• Maintain the information security risk register: risk identification, assessment, treatment tracking and formal acceptance
• Prepare risk reporting for management and governance committees, and track remediation to closure
• Regulatory Compliance
• Support compliance activities under DORA (including the Register of Information), PSD2/EBA ICT guidelines, GDPR and PCI DSS across our licensed entities
• Contribute to operational resilience work for our UK entity under FCA requirements
• Third-Party & Vendor Risk
• Run the third-party risk management lifecycle: due diligence, security questionnaires, risk rating, onboarding gates and periodic reassessment
• Maintain the vendor register and contractual security requirements together with Legal
• Audit & Assurance
• Coordinate internal and external audits (Big-4 ICT audits, regulator requests, PCI QSA cycles) and manage the audit calendar
• Own evidence collection and maintain an evidence library for reuse across audits, certifications and client questionnaires
• GRC Platform, AI & Automation
• Administer and develop our GRC platform: control monitoring, automated evidence collection, framework mapping and reporting
• Apply AI tooling to day-to-day GRC work — policy drafting, gap analysis, evidence assembly, questionnaire responses — and help automate recurring processes
• Contribute to our AI governance Programme: assessing AI vendors, supporting the AI system register and aligning with emerging requirements such as the EU AI Act

What we need:

• 3+ years of experience of similar experience in GRC, information security governance, IT audit or IT risk management
• Working knowledge of ISO/IEC 27001; exposure to DORA, GDPR or PCI DSS
• Experience in regulated financial services (payments, e-money, banking, fintech) or advisory work for such companies
• Hands‑on experience with audits — coordinating them, preparing evidence, remediating findings
• Familiarity with GRC platforms or a strong interest in compliance automation
• Strong written English — your output goes to auditors, regulators and senior stakeholders
• Ability to manage multiple workstreams against fixed deadlines
• Nice to have
• Certifications such as CISA, CRISC, CISM, CIPP/E or ISO 27001 Lead Auditor / Lead Implementer
• Direct experience with DORA implementation, EBA outsourcing guidelines or FCA operational resilience
• Experience implementing or administering a GRC platform (e.g. Vanta, ServiceNow GRC, OneTrust or similar)
• Familiarity with ISO 42001, the EU AI Act or AI risk management
• Light scripting or workflow automation skills (low-code tools)

Hiring Process:

• Step 1 - Thinking in Action (40 minutes) Your first conversation will be with our Talent Acquisition team. We'll explore your background, career journey, motivations, and overall fit for the role. As part of this discussion, you'll also complete a short technical screening that will be reviewed by our engineering team. This stage helps us understand both your experience and how you approach technical challenges
• Step 2 - Hiring Manager interview (60-minutes) you will meet the hiring manager Head of Information Security, to explore your skills, achievements, and alignment with the role
• Step 3 - Final Interview (45 minutes) The final stage is a group interview with senior members of our Technology squad, which may include the CTO, CPO and Head of Security. Together, we’ll discuss team fit, collaboration style, expectations from both sides, and any remaining questions about the role, team, or technology domain. This is also an opportunity for you to learn more about our culture and ways of working

The perks of being a payabl.er:

• Future-Proof Your Finances: Once you've passed probation, we'll kickstart your Provident Fund to secure your future.
• Grow with Us: Annual Learning Budget for professional development (eligible after probation)—because your growth is our growth.
• Wolt Your Way Through Lunch: €150 monthly Wolt allowance to keep you fueled and happy
• Stay Active Your Way: Enjoy a SportsBenefits membership giving you access to a wide variety of gyms and sports facilities to support your active lifestyle
• Drive in Style: After one year with us, you may be eligible for a company car—performance and availability permitting.
• Park with Ease: Complimentary parking space just steps from the office, so your commute is as smooth as your workday
• Max Out Your Downtime: 25 days of vacation + public holidays + 10 days of sick leave
• Shop & Save: Exclusive local discount card + tickets for exciting events like Beonix, basketball games, and more.
• Speak Like a Local: Join free Greek language classes, twice a week, open to all team members.
• Celebrate Together: We bring colleagues from all offices together for unforgettable company celebrations
• Global Collaboration & Events: Opportunities to participate in international company events and initiatives, connecting with colleagues from all regions and contributing to a truly global community

The benefits listed above are for our Cyprus office location only, a list of benefits and contract type will be assessed subject to your location and discussed in the first interview with your Talent Acquisition Partner.

Let's embark on a journey to redefine the landscape of payments together. We're not just offering a role; we're inviting you to be a part of something bigger. Join our team, and let's innovate, disrupt, and lead the future of payments. Together, we can make an impact that resonates. Welcome to the team!

Please review our Privacy Policy to understand how we process your personal data during the recruitment process: https://payabl.com/privacy-policy