Informacijos saugos specialistas (GRC)

About the role

The Information Security Specialist (GRC) will lead the design, implementation and continuous improvement of the group‑wide governance, risk and compliance (GRC) framework for information security. You will ensure that EPSO‑G complies with national cybersecurity legislation, ISO 27001 and other relevant standards.

Key responsibilities

• Develop, implement and refine the information security GRC control system across the EPSO‑G group.
• Monitor and interpret regulatory and legal requirements affecting the energy sector (e.g., Lithuanian Cybersecurity Law, ISO 27001) and organise activities to meet them.
• Assess information security risks at the group level and ensure a unified risk‑assessment process.
• Plan, coordinate and support internal audits, self‑assessments and third‑party assessments.
• Create, update and maintain security policies, procedures and standards.
• Manage third‑party (supplier) information security risks and compliance.
• Develop security metrics, prepare reports and present findings and recommendations to stakeholders.
• Provide governance consulting and collaborate with business units to implement requirements.
• Participate in security incident management from a compliance and third‑party risk perspective.

Required profile

• Higher education in cybersecurity, information technology or a related field.
• Practical experience in information security, GRC, risk management or compliance.
• Deep knowledge of the Lithuanian Cybersecurity Law, ISO/IEC 27001, CIS Controls and other best practices.
• Ability to objectively evaluate risks and make evidence‑based decisions.
• Strong skills in drafting internal regulations, processes and procedures.
• Excellent analytical, communication and organisational abilities.
• Proficiency in Lithuanian and English.

Required skills

• ISO 27001 implementation and auditing
• CIS Controls application
• Risk assessment and management
• Audit coordination
• Third‑party security risk management
• Security metrics development
• Incident response and management
• Compliance with Lithuanian Cybersecurity Law