Governance, Risk and Compliance (GRC) Expert

SoCyber is a Bulgarian cybersecurity company on a mission to solve complex cybersecurity problems and help organizations across all industries and sizes fortify their cybersecurity defenses. We provide a wide range of security, compliance and vulnerability management solutions.

Our passionate team of experts is working on projects covering the full spectrum of digital and physical infrastructure. SoCyber is partnered with leading organizations worldwide, offering you the chance to learn from seasoned professionals and make a real difference in the fight against cyber threats.

SoCyber is looking for an experienced Governance, Risk and Compliance (GRC) Expert to join our tight-knit team of security specialists. This hands-on role involves supporting the ongoing development, implementation, and maintenance of the organization's and our clients' security governance frameworks, risk management processes, and regulatory compliance initiatives.

1. Role Overview

The GRC Expert is responsible for independently executing and coordinating security governance frameworks, risk management procedures, and compliance initiatives for the organization and its clients. Sitting between operational support and high-level advisory, the Employee will lead mid-complexity risk assessments, manage audit preparations, draft core security documentation, and serve as a primary client contact during GRC engagements. The Employee works with minimal supervision while collaborating with senior management on strategic, complex initiatives.

2. Core Duties and Responsibilities

Information Security Governance

• Draft, review, and maintain organizational security policies, procedures, and standards in alignment with industry frameworks.
• Map organizational security processes and technical controls against established governance frameworks.
• Lead operational governance reviews and track actionable deliverables across internal and client-facing teams.

Risk Management Operations & TPRM

• Conduct end-to-end security risk assessments, vulnerability analyses, and threat modeling exercises.
• Maintain enterprise risk registers, track Corrective Action Plans (CAPs), and drive risk remediation efforts.
• Execute Third-Party Risk Management (TPRM) evaluations, including vendor Due Diligence Questionnaires (DDQs) and risk assessments.
• Assist in facilitating tabletop, Business Continuity (BCP), and Disaster Recovery (DRP) exercises.

Regulatory and Framework Compliance

• Execute gap assessments, control mapping, and readiness reviews for major regulatory frameworks, including ISO/IEC 27001, NIST CSF, NIS2, DORA, GDPR, and PCI-DSS.
• Coordinate formal internal and external audit workflows, serving as a primary point of contact for gathering and validating evidentiary artifacts.
• Track compliance metrics and assist in tracking Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs).

Documentation, Reporting, and Client Delivery

• Author professional security reports, risk summaries, and compliance briefings for operational stakeholders and management.
• Maintain GRC tools, control libraries, and documentation repositories.
• Synthesize technical data into executive-ready dashboards and operational reports.
• Support junior team members by providing guidance on standard GRC methodologies and client deliverables.

3. Communication & Interpersonal Skills

• Act as a direct technical liaison between security engineering teams, internal stakeholders, and external clients.
• Facilitate risk workshops, stakeholder interviews, and compliance review meetings with confidence and professionalism.
• Interface effectively with external auditors and regulatory assessors during evaluations.

4. Experience and Qualifications

• Education: Bachelor’s degree in Cybersecurity, Information Technology, Information Security, Risk Management, or equivalent practical experience.
• Experience: 2–4 years of dedicated experience in GRC, IT Audit, or Information Security consulting.
• Technical & Framework Knowledge: A functional understanding of cybersecurity principles, IT infrastructure, and cloud environments. Strong working knowledge of ISO/IEC 27001, NIST CSF, GDPR, and NIS2/DORA requirements.
• Tooling & Analytics: Hands-on experience with GRC platforms, compliance management tools, and risk software. High attention to detail and strong technical writing capabilities.
• Certifications: Preferred (or actively pursuing): ISO 27001 Lead Implementer/Auditor, CGRC, CISA, CRISC, GRCP etc.

5. What we offer

• 25 days off
• Hybrid working
• Friendly and relaxed environment
• Competitive remuneration
• Career development in a progressive start-up