Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 14 hours ago

GRC Analyst

Duco7 open roles

Where
Poland; ul. Marii Curie Skłodowskiej 12 50-381 Wrocław Poland
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowGRC AnalystDuco · Poland; ul. Marii Curie Skłodowskiej 12 50-381 Wrocław Poland

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Duco's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

11.5% of postings close within 7 days. Measured by our own scanner across the market. Duco postings stay open a median of 52 days.

Share of postings closed within
  1. 2.0%1 day
  2. 4.3%3 days
  3. 11.5%7 days
  4. 18.1%14 days
  5. 35.6%30 days
  6. 44.6%60 days
This job: posted 14 hours ago

Duco median: 52 days open

The posting

About Us

Duco is on a mission to reduce the time spent on data-related work by 90%. Our enterprise data automation platform empowers teams to work more efficiently and meaningfully by giving them the ability to automate data controls with the latest technology, such as no-code, the cloud, and AI.

We help firms to start trusting their data, by giving them one intuitive platform to automate the front-to-back processing of all kinds of data (from structured Excels and RTFs to unstructured PDFs and emails). This eliminates the boring manual work across the data lifecycle and enables firms to act faster, work smarter, save money, reduce risk and comply with regulatory requirements.

We’re headquartered in London and have offices in New York, Wroclaw, Singapore, and Antwerp. We’re proud to call some of the largest global financial institutions our clients, including over 15 of the world’s largest international banks, as well as brokers, exchanges, asset managers, hedge funds, administrators, service providers and corporates.

The opportunity

We are seeking a Senior GRC Analyst to support our Security GRC Manager in the preparation and execution of our external audit programme (ISO 27001, SOC 1 and SOC 2). During the initial phase of the role, you will also take ownership of our Enterprise Risk Management Framework. This is a broad remit, encompassing how we demonstrate our commitment to security, how we fulfil our obligations to clients and regulators, and how we identify, assess and monitor security and business risk.

Audit and assurance sit at the core of this position. You will collaborate daily with the Information Security team, external auditors and control owners across the business to ensure the operating effectiveness of our controls can be clearly evidenced. Initially, you will also own the risk register and the processes governing risk appetite, exception management and risk prioritisation, including reporting to our Risk Committee. Over time, responsibility for risk management will transition to another member of the team, enabling you to focus primarily on audit and assurance.

The role is well suited to a structured, detail-oriented professional who is equally comfortable operating at an operational and a strategic level. You will work closely with stakeholders across Security, Legal, Engineering and the Executive Leadership Team.

Reporting to the Security GRC Manager, you will play an integral role in shaping the future direction of Information Security at Duco.

Key responsibilities

Technology risk management (initial phase)

  • Own the enterprise risk register and the frameworks governing risk appetite, exception management and risk prioritisation
  • Ensure the effective identification, quantification, communication and management of technology risk, with an emphasis on root cause analysis and remediation recommendations
  • Conduct Information Security risk assessments across the technology estate and physical locations, and contribute to the end-to-end risk management lifecycle
  • Present risk reporting to Duco’s Executive Leadership Team at Risk Committee meetings

Audit, assurance and compliance

  • Support audit readiness activities, including evidence collection and control walkthroughs, for ISO 27001, SOC 1 and SOC 2 audits
  • Continuously monitor and test control design and operating effectiveness, identifying gaps and strengthening our risk posture and regulatory compliance
  • Track audit findings and remediation actions through to closure
  • Maintain compliance with Duco’s security certifications and accreditations (ISO 27001, SOC 1, SOC 2)
  • Support client audits and wider assurance activities

AI governance

  • Support the review of complex or higher-risk AI use cases and the formulation of recommendations to senior stakeholders
  • Contribute to the development of practical technical standards for responsible AI across the full lifecycle: development, testing, validation, deployment, monitoring and retirement

Policy, third-party risk and security culture

  • Support the development and maintenance of the Information Security Policy Framework in alignment with risk appetite, applicable legislation and industry standards
  • Support the assessment and completion of third-party risk assessments
  • Maintain a sound understanding of the current and emerging threat landscape
  • Promote adherence to security policies and foster a strong Information Security culture across the organisation

Skills and experience

  • A minimum of five years’ experience in Information Security or a comparable role
  • Demonstrable hands-on experience supporting external audits (ISO 27001, SOC 1 and/or SOC 2 Type II), including evidence collection, control testing and direct engagement with auditors
  • Proven experience in technology risk management and information security, with a focus on risk identification, assessment and mitigation
  • Strong understanding of technology systems and cyber/technology risk management activities, including control effectiveness assessments, reporting and mitigation tracking, with the ability to translate technical findings into clear business impact
  • Experience managing or supporting Information Security assessments of third parties
  • Experience supporting an established Information Security Management System (ISMS) and maintaining security accreditations such as ISO 27001, SOC 1 and SOC 2
  • Professional fluency in English, with the confidence to engage directly with UK-based stakeholders and external auditors
  • A track record of operating effectively in a fast-paced, highly collaborative environment
  • Excellent communication, documentation and stakeholder management skills

Desirable

  • Experience within Financial Services or a similarly regulated industry
  • ISO 27001 Lead Auditor or Lead Implementer, CISA or CRISC certification
  • IT audit experience gained at a Big Four or comparable firm
  • Familiarity with the Digital Operational Resilience Act (DORA)
  • Working knowledge of Claude, Rovo, Jira and Confluence

Benefits:

  • Competitive salary package aligned with your skills and experience. Reviewed annually.
  • Annual Performance-based bonus
  • Private Medical Insurance - Inter Polska
  • Life Insurance
  • Multisport Program
  • Unlimited annual holiday, because we trust our people to manage their own time off
  • Enhanced family leave
  • Employee Assistance Programme
  • 4 Volunteering days off
  • Flexible working policy (2 days per week in office)
  • Home working allowance
  • Opportunity to work abroad for up to 6 weeks per year
  • Personal learning and development opportunities (annual dedicated budget)
  • Referral bonus if we hire someone great who you’ve recommended to us
  • Spot Rewards
  • Employee of the Month and Employee of the Year awards
  • Wellbee

Want to do a little more research before you apply?

Head over to our Glassdoor page to learn about our benefits, culture and to find out what our team thinks about life at Duco. You can also find out more about us on LinkedIn

Disclaimer

Because we are committed to inclusivity, we strive to provide equitable opportunities for everyone. If you require accommodation during the recruitment process, please let us know at [email protected]. Include your contact information, the role you're applying for, and how we can accommodate you.

During the interview process and after hire, Duco does not discriminate on the basis of race, colour, gender or gender expression, sexual orientation, marital or pregnancy status, national origin, age, disability, religion or creed, socioeconomic background or status, size, or any other protected characteristic.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Duco's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Duco's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Duco's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.