IT GRC Specialist

About the role

We are looking for a highly organized IT GRC Specialist to join our Security & IT Compliance team. You will own day‑to‑day third‑party risk management, maintain our IT risk register and help mature our internal risk remediation processes.

Key responsibilities

• Conduct and document third‑party risk and vendor security assessments.
• Maintain and continuously update the IT Risk Register with accurate risk data, action plans, owners and due dates.
• Follow up on remediation activities with risk owners, IT teams and other stakeholders until closure.
• Support audit, review and compliance activities by providing risk‑related documentation and evidence.
• Contribute to improving risk‑management processes, templates and reporting practices.

Required profile

• Proven experience managing the full vendor risk lifecycle, from due‑diligence to off‑boarding.
• Hands‑on experience reviewing vendor security compliance reports such as SOC 2 Type II, ISO 27001 and PCI‑DSS.
• Demonstrated ability to maintain an IT Risk Register and apply risk‑assessment methodologies.
• Strong analytical and problem‑solving skills with the ability to communicate risk topics to both technical and non‑technical audiences.

Required skills

• SOC 2 Type II compliance reporting
• ISO 27001 certification knowledge
• PCI‑DSS compliance understanding
• IT Risk Register management
• Risk assessment methodology and risk scoring

What we offer

• Up to 100 % remote work (or hybrid if preferred)
• Flexible working hours with a 34‑hour week
• Competitive full‑time salary
• Access to licence courses, workshops and a badge‑based learning system