Senior Governance, Risk and Compliance Engineer

We are looking for a Senior GRC Specialist to strengthen and mature our information security governance, risk and compliance function. Reporting to the Head of Information Security, you will develop and operate the frameworks, registers and processes that keep a regulated, multi-entity payments group compliant and audit-ready — across ISO 27001-aligned governance, DORA, GDPR, PCI DSS and operational resilience requirements. This is a hands-on senior role with real ownership: you will build programs as well as run them, work with a modern GRC platform, and apply AI and automation to how the work itself gets done.

Responsibilities

Develop, maintain and continuously improve information security policies, standards and procedures aligned with ISO 27001 and regulatory requirements; Operate the policy lifecycle: approval workflows, periodic reviews, ownership and version control across the document estate; Maintain the information security risk register: risk identification, assessment, treatment tracking and formal acceptance; Prepare risk reporting for management and governance committees, and track remediation to closure; Support compliance activities under DORA (including the Register of Information), PSD2/EBA ICT guidelines, GDPR and PCI DSS across our licensed entities; Contribute to operational resilience work for our UK entity under FCA requirements; Run the third-party risk management lifecycle: due diligence, security questionnaires, risk rating, onboarding gates and periodic reassessment; Maintain the vendor register and contractual security requirements together with Legal; Coordinate internal and external audits (Big-4 ICT audits, regulator requests, PCI QSA cycles) and manage the audit calendar; Own evidence collection and maintain an evidence library for reuse across audits, certifications and client questionnaires; Administer and develop our GRC platform: control monitoring, automated evidence collection, framework mapping and reporting; Apply AI tooling to day-to-day GRC work — policy drafting, gap analysis, evidence assembly, questionnaire responses — and help automate recurring processes; Contribute to our AI governance Programme: assessing AI vendors, supporting the AI system register and aligning with emerging requirements such as the EU AI Act

Requirements

3+ years of experience of similar experience in GRC, information security governance, IT audit or IT risk management; Working knowledge of ISO/IEC 27001; exposure to DORA, GDPR or PCI DSS; Experience in regulated financial services (payments, e-money, banking, fintech) or advisory work for such companies; Hands-on experience with audits — coordinating them, preparing evidence, remediating findings; Familiarity with GRC platforms or a strong interest in compliance automation; Strong written English — your output goes to auditors, regulators and senior stakeholders; Ability to manage multiple workstreams against fixed deadlines

Nice to have

Certifications such as CISA, CRISC, CISM, CIPP/E or ISO 27001 Lead Auditor / Lead Implementer; Direct experience with DORA implementation, EBA outsourcing guidelines or FCA operational resilience; Experience implementing or administering a GRC platform (e.g. Vanta, ServiceNow GRC, OneTrust or similar); Familiarity with ISO 42001, the EU AI Act or AI risk management; Light scripting or workflow automation skills (low-code tools)

Benefits

Provident Fund after probation; Annual Learning Budget for professional development (eligible after probation); €150 monthly Wolt allowance; SportsBenefits membership; Company car eligibility after one year; Complimentary parking space; 25 days of vacation + public holidays + 10 days of sick leave; Exclusive local discount card + tickets for events; Free Greek language classes twice a week; Company celebrations; International company events and initiatives