An entry-level role on SPG’s GRC team, where you’ll contribute to GRC and security assessments (primarily NIS2) as well as the implementation of ISMS, prepare regulatory requirements for management documentation, and develop technical expertise in cloud security and IAM.
At SPG, each subject area is its own service line with its own team, its own clients, and its own service portfolio, which is constantly being developed. GRC & Information Security is one of these; it was launched two years ago and now has a well-established core team and a wide variety of active client projects. We’re now expanding the existing team, including by welcoming entry-level candidates. The foundation is already in place, our methods and offerings continue to grow, and you’ll be learning right from the start.
Specific-Group is a 100% owner-managed IT services company. We’ve been in business for over 25 years, with approximately 550 IT experts across more than 14 international locations, covering everything from software engineering, data & AI, Microsoft, infrastructure, and ERP to consulting and information security. We were founded in Vienna, where we currently have 260 employees. About 80% of our IT experts have senior-level experience. In recent years, we have grown by about 25% annually.
You’ll join a team where everyone works on an equal professional footing and will be involved in client projects right from the start. After being onboarded into our client environments and methodologies, you’ll take on your first independent work packages—ranging from preparing an assessment to following up on agreed-upon measures. This role is ideal if you have a degree in a field related to IT or, as a career changer, bring an IT background with you and are interested in the intersection of information security, IT, governance, risk, and compliance. Here, you’ll learn about both governance and technology simultaneously while working with clients in the banking, healthcare, automotive, and energy sectors.
- You will assist with GRC and information security assessments, as well as NIS2/NISG 2026 gap assessments, including document reviews, structured surveys, and the preparation and documentation of client interviews and workshops.
- You will contribute to the establishment and further development of information security management systems (ISMS) and create or revise security policies and process documentation.
- You will identify organizational and technical security measures and use them to develop action plans and implementation roadmaps.
- You will analyze regulatory requirements—particularly NIS2/NISG, DORA, and GDPR—and translate them into clear management documents, reports, and presentations.
- You’ll expand your technical understanding of cloud security, IAM, vulnerability management, and incident management, and learn to assess whether security measures are not only documented but also technically viable.
- As you gain experience, you’ll gain insight into information security risk management, third-party and supplier risk management, business continuity, CISO/ISO back office operations, and GRC tools.
- You will follow up on agreed-upon measures and assist with their implementation.
- Preferred: initial exposure to ISO 27001, NIS2/NISG 2026, or DORA through your studies, an internship, or continuing education.
(2–3 weeks)
- 15–30-minute HR call
- 1-hour meeting with the GRC Service Line Head
- Office at Schwedenplatz, flexible work-from-home option
- Training budget for certifications (e.g., ISO 27001 Foundation, CompTIA Security+, and later CISM or CISSP) and conferences
- Annual pass for Wiener Linien
- On-demand coaching with an external coach
Legal Information
Minimum salary under the collective bargaining agreement: EUR 3,267.00 gross/month (IT-KV, ST1, full-time). Higher salary possible depending on qualifications and experience; specific salary details will be discussed during the first interview.
Diversity & Inclusion
SPG stands for diversity. We welcome applications regardless of gender, age, background, sexual orientation, religion, or disability.