IT GRC Specialist

We are seeking a highly organized and detail-oriented GRC Specialist to join our Security & IT Compliance team. The primary purpose of this role is to strengthen our growing team by driving our daily Third-Party Risk Management and other IT Risk operations. Working closely with our IT Compliance Specialist and cross-functional stakeholders, you will take ownership of day to day Third-Party Risk Management activities while simultaneously helping us mature our internal IT risk register and remediation efforts.

Our IT Department, based in Wiener Neustadt, is part of an international fintech company that provides short- and long-term consumer loans in five countries, both within and outside of Europe. Through our proprietary platform and websites, we deliver an entirely digital lending process, guaranteeing cash flow to the consumer in just a few minutes.

YOUR RESPONSIBILITIES

• Take ownership of third-party risk and vendor security assessments.
• Maintain and update the IT Risk Register, ensuring risks, action plans, statuses, due dates and owners are accurately recorded.
• Follow up on remediation activities with risk owners, IT teams and other stake holders, and track progress until closure.
• Support the identification, assessment, prioritization and review of IT risks in cooperation with relevant stakeholders.
• Support audits, reviews and compliance activities by providing risk-related documentation, evidence and explanations of the risk management process.
• Contribute to improving IT risk management processes, templates, and reporting practices.

WE WILL OFFER YOU

• Remote work - up to 100% remote, or hybrid, if possible, up to you
• Flexible working hours - only need to cover core working hours with the team
• 34 hours working week - have more time for you and your hobbies at a competitive full time salary
• License courses, workshops and learning opportunities within a badge system

WE EXPECT FROM YOU

• Experience managing the vendor risk lifecycle, from initial due diligence and onboarding to continuous monitoring and offboarding.
• Hands-on experience reviewing vendor security compliance reports (e.g., SOC 2 Type II, ISO 27001 certifications, PCI-DSS).
• Demonstrated experience maintaining and updating an IT Risk Register, ensuring risks are accurately documented, classified, and assigned ownership.
• Knowledge of risk assessment methodologies, including calculating risk scores and defining appropriate risk treatment plans.
• Good understanding of IT processes and ability to discuss risk topics with both technical and non-technical stakeholders.
• Good analytical and problem solving skills, with the ability to understand risk issues, ask relevant questions, and help drive actions to closure.

COUNTRY, YOU ARE LOCATED

• Latvia
• European Union (as B2B) possible