Senior Digital GRC Specialist

payabl.; United States; Hybrid; USD 78,000 - 123,000; Full time

Benefits offered by this job

Annual Learning Budget

Job summary

payabl. is seeking a Senior GRC Specialist to mature governance, risk and compliance across ISO 27001, DORA, GDPR and PCI DSS. You will own policies, risk registers, and audit readiness for a multi-entity payments group, with hands-on program delivery and AI-enabled automation.

You will manage third-party risk, support FCA-regulated activity for the UK entity, and coordinate Big Four ICT audits with a modern GRC platform, while steering the AI governance program and vendor assessments.

Qualifications

• 3+ years in GRC, information security governance, IT audit or IT risk management.
• Working knowledge of ISO/IEC 27001; exposure to DORA, GDPR or PCI DSS.
• Experience in regulated financial services or advisory work for such companies.
• Hands-on experience coordinating audits and producing evidence for findings.
• Familiarity with GRC platforms or strong interest in compliance automation.
• Strong written English, suitable for auditors, regulators and senior stakeholders.

Responsibilities

• Develop and mature information security policies, standards, and procedures aligned with ISO 27001.
• Manage full policy lifecycle, including approvals, reviews, ownership, and version control.
• Maintain the information security risk register and track remediation actions.
• Prepare risk reports for management and governance committees.
• Support compliance activities under DORA, GDPR, PCI DSS and PSD2 across licensed entities.
• Coordinate internal and external audits and manage the audit calendar.

Skills

GRC experience

ISO 27001

Audits coordination

AI in GRC

English writing

Multitask management

Regulatory awareness

Scripting / low-code

Tools

Vanta

ServiceNow GRC

OneTrust

Job description

The role is about:
We are looking for a Senior GRC Specialist to strengthen and mature our information security governance, risk and compliance function. Reporting to the Head of Information Security, you will develop and operate the frameworks, registers and processes that keep a regulated, multi-entity payments group compliant and audit-ready — across ISO 27001-aligned governance, DORA, GDPR, PCI DSS and operational resilience requirements.
This is a hands-on senior role with real ownership: you will build programs as well as run them, work with a modern GRC platform, and apply AI and automation to how the work itself gets done.

• Location: Onsite in Limassol, Cyprus or fully remote from Portugal or Poland
• Reporting to: Head of Information Security

What will you do:

• Developing, maintaining, and continuously improving information security policies, standards, and procedures aligned with ISO 27001 and applicable regulatory requirements.
• Managing the full policy lifecycle, including approval workflows, periodic reviews, ownership, and version control across the document estate.
• Maintaining the information security risk register, including risk identification, assessment, treatment tracking, and formal risk acceptance.
• Preparing risk reporting for management and governance committees, and tracking remediation actions through to closure.
• Supporting compliance activities under DORA, including the Register of Information, as well as PSD2 / EBA ICT guidelines, GDPR, and PCI DSS across our licensed entities.
• Contributing to operational resilience activities for our UK entity in line with FCA requirements.
• Managing the third-party risk management lifecycle, including due diligence, security questionnaires, risk rating, onboarding gates, and periodic reassessments.
• Maintaining the vendor register and contractual security requirements in collaboration with the Legal team.
• Coordinating internal and external audits, including Big Four ICT audits, regulator requests, and PCI QSA cycles, and managing the audit calendar.
• Owning evidence collection and maintaining an evidence library for reuse across audits, certifications, and client questionnaires.
• Administering and developing our GRC platform, including control monitoring, automated evidence collection, framework mapping, and reporting.
• Applying AI tools to day-to-day GRC activities, including policy drafting, gap analysis, evidence assembly, and questionnaire responses, while helping to automate recurring processes.
• Contributing to our AI governance programme, including the assessment of AI vendors, support of the AI system register, and alignment with emerging regulatory requirements such as the EU AI Act.

What we need:

• 3+ years of experience of similar experience in GRC, information security governance, IT audit or IT risk management
• Working knowledge of ISO/IEC 27001; exposure to DORA, GDPR or PCI DSS
• Experience in regulated financial services (payments, e-money, banking, fintech) or advisory work for such companies
• Hands‑on experience with audits — coordinating them, preparing evidence, remediating findings
• Familiarity with GRC platforms or a strong interest in compliance automation
• Strong written English — your output goes to auditors, regulators and senior stakeholders
• Ability to manage multiple workstreams against fixed deadlines
• Nice to have
• Certifications such as CISA, CRISC, CISM, CIPP/E or ISO 27001 Lead Auditor / Lead Implementer
• Direct experience with DORA implementation, EBA outsourcing guidelines or FCA operational resilience
• Experience implementing or administering a GRC platform (e.g. Vanta, ServiceNow GRC, OneTrust or similar)
• Familiarity with ISO 42001, the EU AI Act or AI risk management
• Light scripting or workflow automation skills (low‑code tools)

The perks of being a payabl.er:

• Grow with Us: Annual Learning Budget for professional …