At least three years' experience in information security governance, risk and compliance (GRC) or a management system role.
Hands-on experience maintaining an ISO/IEC 27001 information security management system, including the Statement of Applicability, risk assessment, and management review.
Strong working knowledge of ISO/IEC 27001 and ISO/IEC 27002 controls and information security risk assessment methods.
Sound understanding of GDPR, DORA, and NIS2, and the ability to translate regulatory text into practical controls, policies, and evidence.
Experience drafting clear policies, procedures, minutes, and reports.
Ability to manage review cycles, audit schedules, and multiple deadlines simultaneously.
Ability to explain governance requirements to technical, non-technical, and customer audiences.
Working knowledge of Microsoft 365 tools, including SharePoint, Teams, and Excel, for document control, action tracking, and reporting.
Responsibilities
Own and maintain the IMS documentation set, including the scope statement, Statement of Applicability, information security policies, procedures, standards, and records, with clear version control and scheduled review cycles.
Maintain the information security risk register and risk treatment plans; work with risk and control owners to run the annual risk assessment and track treatment actions to closure.
Plan and run the internal audit programme, and coordinate external certification, surveillance, and recertification audits with the certification body.
Manage nonconformities, observations, and corrective actions, including root-cause analysis and verification that actions are effective.
Define, collect, and report IMS performance measures and control effectiveness metrics.
Maintain the control ownership model and an organised evidence repository so evidence is available for audits and customer requests.
Support information security awareness and policy training delivery, and track policy acknowledgements.
Maintain a unified control framework mapping the IMS to ISO/IEC 27001, DORA, and NIS2 requirements so that one control and piece of evidence can satisfy multiple obligations.
Extend IMS policies and procedures to cover DORA and NIS2 areas, including ICT risk management, incident classification and reporting, business continuity and resilience testing, supply chain and ICT third-party risk, and management body accountability.
Support incident reporting procedures so regulatory notification timelines, such as NIS2 early warning, notification, and final report stages, can be met.
Monitor regulatory developments and guidance from relevant EU and Irish authorities, assess their impact on the IMS, and recommend changes.
Track and report remediation actions arising from GDPR, DORA, and NIS2.
Support responses to customer security questionnaires, due diligence requests, tenders, and security sections of RFPs.
Prepare and manage customer assurance evidence packs, including certificates, policy summaries, and control descriptions.
Support customer audits and annual governance reviews, including coordinating dates and the status of policies and other requested documents.
Attend customer meetings when required.
Translate contractual and regulatory security requirements from customers into IMS controls and actions.
Internal Governance Officer
Nostra is a leading Managed Service Provider (MSP) in Ireland, dedicated to delivering advanced IT solutions that enable businesses to build reliable, secure, and scalable IT foundations. With a commitment to continuous improvement, we serve a diverse range of industries, providing exceptional services that empower our clients to focus on their core business goals.
The Internal Governance Officer is the day-to-day custodian of Nostra's Integrated Management System (IMS), which is built on the ISO/IEC 27001 information security management standard. The role keeps the IMS current, evidenced and audit-ready, and makes sure it works as a living system that the business actually uses rather than a set of documents that are only refreshed before an audit.
This role will be based in one of our Dublin (HQ), Galway, or Cork offices.
Responsibilities: IMS Ownership & Maintenance:
Own and maintain the IMS documentation set, including the scope statement, Statement of Applicability, information security policies, procedures, standards and records, with clear version control and scheduled review cycles.
Maintain the information security risk register and risk treatment plans, working with risk and control owners to run the annual risk assessment and track treatment actions to closure.
Plan and run the internal audit programme, and coordinate external certification, surveillance and recertification audits with the certification body.
Manage nonconformities, observations and corrective actions, including root-cause analysis and verification that actions are effective.
Define, collect and report IMS performance measures and control effectiveness metrics.
Maintain the control ownership model and a well-organised evidence repository so that evidence is always available for audits and customer requests.
Support the delivery of information security awareness and policy training and track policy acknowledgements.
DORA & NIS2 Alignment:
Maintain a unified control framework that maps the IMS to ISO/IEC 27001, DORA and NIS2 requirements, so that one control and one piece of evidence can satisfy several obligations.
Extend IMS policies and procedures to cover DORA and NIS2 areas such as ICT risk management, incident classification and reporting, business continuity and resilience testing, supply chain and ICT third-party risk, and management body accountability.
Support incident reporting procedures so that regulatory notification timelines (for example the NIS2 early warning, notification and final report stages) can be met.
Monitor regulatory developments and guidance from relevant EU and Irish authorities, assess the impact on the IMS and recommend changes.
Track and report remediation actions arising from GDPR, DORA and NIS2.
Customer-Facing Support:
Support responses to customer security questionnaires, due diligence requests, tenders and RFP security sections.
Prepare and manage customer assurance evidence packs, including certificates, policy summaries and control descriptions.
Support customer audits and annual governance reviews, including coordinating the dates and status of policies and other requested documents.
Attend customer meetings on the when required.
Help translate contractual and regulatory security requirements from customers into IMS controls and actions.
Requirements:
At least three years' experience in information security governance, risk and compliance (GRC) or management system role.
Hands-on experience maintaining an ISO/IEC 27001 information security management system, including the Statement of Applicability, risk assessment and management review.
Strong working knowledge of ISO/IEC 27001 and ISO/IEC 27002 controls and of information security risk assessment methods.
Sound understanding of GDPR, DORA and NIS2 and the ability to translate regulatory text into practical controls, policies and evidence.
Excellent written skills, with experience drafting clear policies, procedures, minutes and reports.
Highly organised, with the ability to manage review cycles, audit schedules and multiple deadlines at once.
Confident communicator who can explain governance requirements to technical, non-technical and customer audiences.
Good working knowledge of Microsoft 365 tools such as SharePoint, Teams and Excel for document control, action tracking and reporting.
Benefits:
Generous Professional Development Budget.
Company Pension.
Health Insurance.
Wellness Benefit.
On-site Gym.
Health & Fitness Benefit.
Employee Assistance Program.
Company Events.
At Nostra we value our people. We are a passionate team committed to doing our best, our values are trust, accountability, expertise, people, integrity, and empathy. These values form a central part of our recruitment process. Nostra is an equal opportunity employer committed to diversity and inclusion.