Senior Governance Risk and Compliance Expert in Warsaw

Are you a Senior GRC Expert? Think bigger about your next move! Build your future with QnR Group.

Senior Governance Risk and Compliance Expert | Quality & Reliability (QnR), the parent company of QnR Group

Role overview

We are looking for a Senior Governance Risk and Compliance Expert to join one of our Public sector clients based in Warsaw, Poland, working remotely. You will ensuring that IT operations align with EU data protection legislation, conducting privacy impact assessments, maintaining records of processing activities and advising stakeholders across the organisation on their obligations.

About QnR Group QnR Groupis a technology group with 35 years of experience, 8 companies, 4 delivery centers and 210+ professionals across Greece, Belgium, Cyprus and Poland. Listed on the Athens Stock Exchange since 2000, we deliver mission-critical digital transformation projects for the public and private sector. The Group’s capabilities coverssoftware engineering, enterprise and generative AI, cybersecurity, cloud infrastructure, SAP and ServiceNow solutions, core banking and maritime intelligence.

What you'll work on:

Ensuring IT operations comply with data privacy laws, regulations and standards

Conducting privacy impact assessments (DPIAs) and maintaining records of processing activities (RoPAs)

Identifying compliance gaps and proposing practical countermeasures

Advising on data protection matters, particularly around personal data processing

Developing, maintaining and communicating data privacy policies and procedures

Delivering staff awareness training to foster a culture of data protection

Acting as the contact point for queries and complaints related to data processing

Cooperating with authorities and professional groups on data protection matters

Managing legal aspects of information security and third-party relations

What you bring:

At least 5+ years of IT experience and 4+ years in a GRC role

Master’s degree

in Computer Science, Engineering or a related technical field

Hands‑on data protection compliance experience in an ICT, EU institutional, or public-sector environment

Experience in preparing or reviewing RoPAs, DPIAs, Data Processing Agreements, and Transfer Impact Assessments, including data mapping and input validation from technical owners

Experience in documenting technical arrangements relevant to data protection: access rights, privileged access, logs/SIEM exports, retention, data flows, processors and subprocessors

Deep knowledge of EU data protection legislation, regulatory frameworks, and privacy standards

Ability to work with incomplete or inconsistent ICT information, distinguishing facts from assumptions, identifying gaps and structuring clear follow-up

Strong communication skills, able to explain data protection topics to both technical and non-technical audiences

English C1 level certification

Certifications you'll need:

At least 3 certifications from the following:

CISA — Certified Information Systems Auditor

CISM — Certified Information Security Manager

GSNA — GIAC Systems and Network Auditor

GCCC — GIAC Critical Controls

ISO 27001 Lead Implementer

ISO 27001 Lead Auditor

ISO 27005 Risk Manager

CAP — (ISC)² Certified Authorization Professional

CRISC — ISACA Certified in Risk and Information Systems Control

CISSP-ISSMP — (ISC)² Information Systems Security Management Professional

GIAC Certified ISO-27000 Specialist

or internationally recognised equivalent (subject to EU-I acceptance)

Nice to have

Prior experience in an EU institutional environment.

Familiarity with the practical implications of evolving EU legal frameworks on organisational data protection strategy.

Experience collaborating across multidisciplinary teams including cybersecurity, SOC, and architecture functions.

#J-18808-Ljbffr