The posting
Build. Test. Deliver. Enjoy at Pepco!
About the role
At Pepco, we’re growing fast and building our Tech Hub in Porto to support our business across Europe.
We are looking for a Senior Cyber Risk & Assurance Specialist to join our growing Cyber Security team.
In this role, you will act as a senior subject matter expert, leading cyber risk management, governance, compliance, assurance and third-party risk activities across the business. You'll work closely with technology and business stakeholders, helping to strengthen our security posture while supporting the rapid growth and digital transformation of one of Europe's fastest-growing retailers.
If you enjoy taking ownership, influencing decisions, and helping organizations manage cyber risk in a practical and business-oriented way, you'll fit right in.
What you’ll be doing
- Lead cyber risk assessments across business and technology domains.
- Support risk identification, evaluation, mitigation and reporting activities.
- Provide guidance on cyber risk management practices and risk treatment strategies.
- Contribute to the development and continuous improvement of security policies, standards and governance frameworks.
- Lead and support compliance activities related to ISO 27001, NIS2, GDPR, PCI-DSS and other regulatory requirements.
- Coordinate internal and external audits, compliance reviews and remediation activities.
- Perform third-party security assessments and vendor due diligence reviews.
- Monitor supplier-related cyber risks and support ongoing assurance activities.
- Participate in control validation, assurance testing and cyber resilience exercises.
- Support security awareness initiatives and help promote a strong security culture across the organization.
- Collaborate with Security Operations, Security Architecture, Internal Audit, Legal, Privacy, Procurement and other key stakeholders.
- Mentor junior team members and contribute to the continuous improvement of the Cyber Risk & Assurance function.
What we’re looking for
- Bachelor's or Master's degree in Cybersecurity, Information Security, Information Technology, Risk Management, Business Administration or a related field.
- Minimum 7 years of experience in cybersecurity, risk management, governance, compliance, audit or assurance functions.
- Proven experience conducting cyber risk assessments, control reviews and compliance activities.
- Strong knowledge of cyber risk management frameworks and industry standards such as ISO 27001, NIST CSF and CIS Controls.
- Experience supporting regulatory compliance and audit programmes.
- Good understanding of NIS2, GDPR, PCI-DSS and related regulatory requirements.
- Experience with third-party risk management, vendor assurance or supplier security reviews is highly desirable.
- Strong analytical thinking and risk-based decision-making capabilities.
- Excellent stakeholder management and communication skills.
- Ability to communicate effectively with both technical and non-technical audiences.
- Experience working within complex, multinational environments.
- Fluent English (written and spoken)
What we offer
- Hybrid model: 2 days remote / 3 days onsite
- Office based in Porto: 📍 https://maps.app.goo.gl/Nn7hc6uYrmPiT8Fc9
- Competitive salary and annual bonus
- Health insurance from the month after joining
- Meal allowance
- Employee discount in Pepco stores in Portugal
- Learning and development opportunities
- International exposure and collaboration across markets
- A simple, down-to-earth culture where people support each other
About Pepco
Pepco is one of Europe’s fastest-growing retail companies, with thousands of stores and millions of customers visiting us every month. Behind that growth, there’s a team of people who make things happen. We keep things simple, we focus on results, and we support each other to get there. At Pepco, no two days are the same. And that’s exactly how we like it.
Interested? Apply now and be part of building something new in Porto!
