GRC Specialist (Information Security & Privacy)

Location: Riga, Latvia; hybrid working model combining collaboration in the Riga office with remote work.

Salary: gross monthly salary of EUR 3,200–4,200, depending on experience and qualifications.

Company

Work with an established, publicly traded company and international colleagues across Information Security, IT, Legal and business teams.

What you will do

• Support the Information Security Management System (ISMS), including ISO 27001 audits and certification activities.
• Coordinate risk assessments, vulnerability scanning and penetration testing, and track remediation actions through completion.
• Support Data Protection Impact Assessments (DPIAs), privacy risk assessments and maintenance of records of processing activities (RoPA).
• Prepare for external audits, including ISAE 3402/SOC 1 and IT financial audits, by coordinating evidence and following up on findings.
• Maintain and improve security policies, privacy standards, procedures and related documentation.
• Work with technical and business stakeholders to identify risks, explain requirements and agree on practical security and privacy controls.

Requirements

• Practical experience in GRC, information security, audit, risk management or data privacy, ideally 2–5 years; candidates earlier in their careers with a solid foundation and motivation to develop are also considered.
• Working understanding of ISO 27001, ISMS principles, organizational risk assessment and control monitoring.
• Experience supporting audits, risk assessments or compliance activities.
• Understanding of data protection principles and interest in developing privacy expertise.
• Strong organizational skills, attention to detail and ability to follow up on actions across several teams.
• Clear spoken and written English and confidence communicating with technical and business colleagues.
• Collaborative, practical approach focused on understanding business needs and finding solutions that meet security and privacy requirements.

Nice to have

• Hands-on GDPR experience, including DPIAs, privacy audits, RoPA or personal data incident assessments.
• ISO 27001 Auditor or Implementer certification.
• Other relevant certifications such as CIPP/E, CIPM, CRISC, CISA or Security+.

Culture & Benefits

• Environment that encourages new ideas and practical improvements, supported by the stability and resources of an established company.
• Opportunities to develop expertise across GRC and data privacy, with potential involvement in AI governance and compliance projects.
• Hybrid work combining office collaboration in Riga with remote work.
• Health insurance, contemporary office environment, development opportunities, hackathons and other benefits.