Cybersecurity Analyst – GRC (Risk & Control)

About the role

Spendesk is seeking an ICT Risk & Control Officer to strengthen its internal control framework and support a strong risk culture across the fintech business. Reporting to the Head of Security, you will focus on cyber controls, ensuring the confidentiality, integrity, and availability of information systems while meeting security certification and regulatory requirements.

Key responsibilities

• Execute second‑level controls according to the control plan, documenting findings and following up on remediation.
• Coordinate and monitor action plans arising from control gaps, incidents, or weaknesses with relevant business teams.
• Prepare concise reports on control activities, risk topics, and corrective‑action progress for internal stakeholders and risk review committees.
• Contribute to the design, review, and continuous improvement of the cybersecurity aspects of the control plan.
• Assist in managing security certifications such as ISO 27001, SOC 2, and PCI‑DSS.
• Promote a risk‑based approach by raising employee awareness and encouraging best practices.

Required profile

• Minimum 3 years of experience in permanent control, internal control, risk management or audit.
• Background in a financial institution, regulated fintech, payment or e‑money organization.
• Good understanding of fintech business models and their regulatory environment.
• Strong analytical and synthesis abilities with sound judgement.

Required skills

• Knowledge of ISO 27001 security framework.
• Familiarity with SOC 2 compliance requirements.
• Experience with PCI‑DSS standards.
• Understanding of DORA regulatory framework.