Senior Governance Risk and Compliance Expert

Are you a Senior GRC Expert? Think bigger about your next move!

Build your future with QnR Group. JOIN THE NEXT EUROPEAN TECHNOLOGY POWERHOUSE 🚀

Senior Governance Risk and Compliance Expert | Quality & Reliability (QnR), the parent company of QnR Group

Role overview

We are looking for a Senior Governance Risk and Compliance Expert to join one of our Public sector clients based in Warsaw, Poland, working remotely. You will ensuring that IT operations align with EU data protection legislation, conducting privacy impact assessments, maintaining records of processing activities and advising stakeholders across the organisation on their obligations.

About QnR Group

QnR Group is a technology group with 35 years of experience, 8 companies, 4 delivery centers and 210+ professionals across Greece, Belgium, Cyprus and Poland. Listed on the Athens Stock Exchange since 2000, we deliver mission-critical digital transformation projects for the public and private sector. The Group’s capabilities covers software engineering, enterprise and generative AI, cybersecurity, cloud infrastructure, SAP and ServiceNow solutions, core banking and maritime intelligence.

Requirements

What you'll work on:

• Ensuring IT operations comply with data privacy laws, regulations and standards
• Conducting privacy impact assessments (DPIAs) and maintaining records of processing activities (RoPAs)
• Identifying compliance gaps and proposing practical countermeasures
• Advising on data protection matters, particularly around personal data processing
• Developing, maintaining and communicating data privacy policies and procedures
• Delivering staff awareness training to foster a culture of data protection
• Acting as the contact point for queries and complaints related to data processing
• Cooperating with authorities and professional groups on data protection matters
• Managing legal aspects of information security and third-party relations

What you bring:

• At least 5+ years of IT experience and 4+ years in a GRC role
• Master’s degree in Computer Science, Engineering or a related technical field
• Hands-on data protection compliance experience in an ICT, EU institutional, or public-sector environment
• Experience in preparing or reviewing RoPAs, DPIAs, Data Processing Agreements, and Transfer Impact Assessments, including data mapping and input validation from technical owners
• Experience in documenting technical arrangements relevant to data protection: access rights, privileged access, logs/SIEM exports, retention, data flows, processors and subprocessors
• Deep knowledge of EU data protection legislation, regulatory frameworks, and privacy standards
• Ability to work with incomplete or inconsistent ICT information, distinguishing facts from assumptions, identifying gaps and structuring clear follow-up
• Strong communication skills, able to explain data protection topics to both technical and non-technical audiences
• English C1 level certification

Certifications you'll need:

At least 3 certifications from the following:

• CISA — Certified Information Systems Auditor
• CISM — Certified Information Security Manager
• GSNA — GIAC Systems and Network Auditor
• GCCC — GIAC Critical Controls
• ISO 27001 Lead Implementer
• ISO 27001 Lead Auditor
• ISO 27005 Risk Manager
• CAP — (ISC)² Certified Authorization Professional
• CRISC — ISACA Certified in Risk and Information Systems Control
• CISSP-ISSMP — (ISC)² Information Systems Security Management Professional
• GIAC Certified ISO-27000 Specialist
• or internationally recognised equivalent (subject to EU-I acceptance)

Nice to have

• Prior experience in an EU institutional environment.
• Familiarity with the practical implications of evolving EU legal frameworks on organisational data protection strategy.
• Experience collaborating across multidisciplinary teams including cybersecurity, SOC, and architecture functions.