Information Security & Compliance Consultant

ABOUT THE ROLE

We are looking for an Information Security & Compliance Consultant to manage and deliver client projects in the areas of information security, cybersecurity, data protection and regulatory compliance.

The successful candidate will take ownership of a portfolio of clients and projects, supporting organisations in the implementation, maintenance and continuous improvement of ISO/IEC 27001 Information Security Management Systems (ISMS) and in their compliance with regulatory frameworks including NIS2, DORA and GDPR.

The role combines strong technical and regulatory knowledge with hands-on consulting, audit preparation, risk management and client relationship management. The consultant will also contribute to the maintenance and continuous improvement of Roboyo's internal management systems.

MAIN RESPONSIBILITIES

Lead the implementation, maintenance and continuous improvement of ISO/IEC 27001 Information Security Management Systems (ISMS) for clients.

Perform ISO 27001 gap assessments, readiness assessments and support organisations throughout certification and surveillance audit processes

Support organisations in assessing and implementing requirements arising from NIS2, including governance, cybersecurity risk management measures, incident management, business continuity, supply-chain security and compliance monitoring.

Support financial-sector clients and ICT service providers with DORA compliance, including ICT risk management, incident management, operational resilience and ICT third-party risk.

Provide GDPR/data protection advisory services, including privacy governance, risk assessments, policies, procedures and, where applicable, DPO services.

Conduct and coordinate information security risk assessments, supporting the definition and monitoring of risk treatment plans.

Develop, review and maintain information security and compliance documentation, including policies, procedures, risk registers, Statements of Applicability and supporting evidence.

Coordinate and/or perform internal ISO 27001 audits and support external certification audits.

Coordinate activities with certification bodies, auditors, customers and specialised cybersecurity providers.

Support customers in establishing and improving third-party/supplier security and due diligence processes.

Support incident management, business continuity and information security governance activities.

Identify compliance gaps and define pragmatic remediation plans with customers.

Manage multiple customer engagements, including project planning, deliverables, service hours and agreed milestones.

Participate in customer meetings, workshops, presentations and demonstrations of consulting services and compliance solutions.

Contribute to commercial activities, including demos, explore meetings, scope definition, effort estimation and preparation of proposals for information security and compliance project

MANDATORY REQUIREMENTS

Higher education in Information Security, Cybersecurity, Information Systems, Engineering, Management, Law or a related field.

Proven hands-on experience implementing and/or maintaining ISO/IEC 27001 ISMS.

Practical knowledge of ISO/IEC 27001:2022 requirements and information security risk management.

Demonstrable knowledge and project experience related to NIS2 requirements and cybersecurity governance.

Strong knowledge of GDPR and data protection principles.

Knowledge of DORA and ICT risk/compliance requirements.

Experience preparing organisations for internal, certification and/or surveillance audits.

Ability to develop information security policies, procedures, risk assessments and compliance documentation.

Strong customer-facing and stakeholder-management skills.

Ability to manage multiple customers and projects independently.

Good written and verbal communication skills in Portuguese and English.

CERTIFICATION

At least one of the following certifications, or equivalent recognised certification:

ISO/IEC 27001 Lead Implementer

ISO/IEC 27001 Lead Auditor

Candidates holding both Lead Implementer and Lead Auditor certifications will be strongly preferred.

VALUED REQUIREMENTS

Both ISO/IEC 27001 Lead Implementer and Lead Auditor certifications.

DPO / Data Protection certification.

Additional information security or risk certifications.

Experience with ISO/IEC 27701 Privacy Information Management Systems.

Experience with other management system standards, particularly ISO 9001, ISO 22301, ISO 37001 or ISO 13485.

Experience with third-party risk management, supplier assessments and due diligence.

Experience with business continuity, incident response and operational resilience.

Experience coordinating penetration testing, vulnerability assessments or other cybersecurity assurance activities with specialist providers.

Previous consulting experience and responsibility for managing a portfolio of customers.

Experience preparing commercial proposals and estimating information security/compliance projects.

BEHAVIOURAL PROFILE

Autonomous and accountable, able to take ownership of client engagements from assessment through implementation and audit.

Strong organisational skills and ability to manage multiple clients, priorities and deadlines simultaneously.

Analytical mindset with strong attention to detail.

Ability to translate complex regulatory and technical requirements into practical actions for customers.

Proactive approach to identifying risks, compliance gaps and improvement opportunities.

Strong written and verbal communication skills, particularly in customer-facing environments.

Comfortable facilitating workshops and interacting with management, technical teams, auditors and external partners.

Pragmatic and solution-oriented approach to compliance.

Strong team spirit and willingness to collaborate with internal and external specialists.