Cybersecurity Governance Risk and Compliance Consultant

Project Background
The assignment is part of a Request for Service under a framework contract focused on strengthening cybersecurity governance, risk, and compliance capabilities. The consultant will support compliance with cybersecurity laws, standards, and privacy regulations, while contributing to the organization’s cybersecurity strategy, policies, and operational processes.

Key Responsibilities

• Ensure compliance with data privacy and data protection standards, laws, and regulations
• Provide legal advice and guidance on cybersecurity and data protection topics
• Identify and document compliance gaps and propose remediation actions
• Conduct privacy impact assessments and maintain relevant policies and procedures
• Promote and enforce the organization’s data protection program
• Act as a point of contact for queries and complaints regarding data processing
• Support design, implementation, auditing, and compliance testing activities
• Monitor audits and data protection-related training activities
• Contribute to the development of cybersecurity strategies, policies, and procedures
• Develop and deliver staff awareness and training initiatives
• Manage legal aspects of information security and third-party relationships
• Collaborate with stakeholders, authorities, and professional groups on cybersecurity and compliance matters

Required Profile & Qualifications

• Advanced-level Cybersecurity Governance, Risk, and Compliance Consultant
• Minimum 5+ years of experience in cybersecurity GRC with focus on risk management
• Proven experience in designing or operationalizing cyber risk management frameworks
• Hands-on experience with ServiceNow GRC (IRM, Risk, Policy and Compliance modules)
• Experience maintaining and managing cybersecurity risk registers
• Experience integrating risk management with vulnerability, incident, cloud, and third-party risk management
• Experience contributing to cybersecurity maturity improvement programmes

Education & Experience

• University degree (EQF Level 7)
• Minimum 9 years of IT-related professional experience
• Minimum 8 years of experience in similar roles

Technical Knowledge
Mandatory:

• Knowledge of cybersecurity laws, regulations, and legislation
• Knowledge of cybersecurity standards, methodologies, frameworks, and policies
• Knowledge of legal and regulatory compliance requirements and best practices
• Knowledge of privacy impact assessment standards and methodologies
• Ability to align cybersecurity and privacy requirements with business strategy
• Ability to develop and implement cybersecurity and privacy policies
• Ability to conduct privacy impact assessments and communicate findings
• Strong communication of data protection concepts to stakeholders
• Understanding of ethical standards and legal framework implications
• Strong collaboration skills

Language
Working knowledge of English (C1 level required)

Engagement Terms

• Freelance-based engagement
• Full-time (40 hours/week), flexible hours negotiable
• Initial 230 working days, with potential extensions up to a total of 920 days over 4 years

Service delivery: On-site