At SPG, each subject area is its own service line (= department) with its own team, its own clients, and its own service portfolio, which is constantly being refined. GRC & Information Security is one of these; it was launched two years ago and now has a well-established core team and a wide variety of
Specific-Group is a 100% owner-managed IT services company. We’ve been in business for over 25 years, with approximately 550 IT experts across more than 14 international locations, covering everything from software engineering, data & AI, Microsoft, infrastructure, and ERP to consulting and information security. We were founded in Vienna, where we currently have 260 employees. About 80% of our IT experts have senior-level experience. In recent years, we have grown by about 25% annually.
You’ll join a team where everyone works on an equal professional footing and quickly entrusts you with responsibility. After a brief orientation to our clients and methodologies, you’ll take on your own projects, ranging from assessments to implementation support. This role is ideal if you’ve already managed assessments independently—such as an ISO 27001 gap assessment or a NIS 2 gap assessment. Here, you’ll combine your GRC expertise with your understanding of security to serve clients in the banking, healthcare, automotive, and energy sectors.
Qualifications
- You will independently manage defined work packages in client projects and provide operational support to clients in implementing agreed-upon measures.
- You will independently conduct security assessments, NIS2/NISG 2026 gap assessments, and risk and maturity level analyses, including document reviews, structured interviews, and technical client workshops.
- You will assess whether security measures are not only documented but also technically viable.
- You will help establish information security management systems (ISMS) for clients and create or revise security policies, guidelines, processes, and governance documentation.
- You identify security and compliance gaps across cloud security, IAM, vulnerability management, and incident management, and derive concrete action plans and implementation roadmaps from these findings.
- You provide support for CISO-as-a-Service, vCISO, and ISO back-office engagements, as well as information security risk management, third-party and supplier risk management, business continuity, and crisis management.
- You will assist with the evaluation and implementation of GRC tools, prepare security KPIs and KRIs for management, and create high-quality reports, analyses, and management presentations.
Preferred: Certifications such as CISA, CISM, CISSP, CCSP, SSCP, ITIL, or CIPP/E.
(2–3 weeks)
15–30-minute HR call
1-hour meeting with the GRC Service Line Head
- Office at Schwedenplatz, flexible work-from-home option
- Training budget for certifications (e.g., CISM, CISSP, ISO 27001 Lead Auditor) and conferences
- Performance bonus
- Annual pass for Wiener Linien
- On-demand coaching with an external coach
Legal Information
Minimum salary under the collective bargaining agreement: EUR 5,444.00 gross per month (IT Collective Bargaining Agreement, ST2, full-time). Significantly higher salary possible depending on qualifications and experience; specific salary details will be discussed during the first interview.
Diversity & Inclusion
SPG stands for diversity. We welcome applications regardless of gender, age, background, sexual orientation, religion, or disability.