<div class="content-intro"><p><span data-contrast="none">We’re always looking for the ones </span><span style="color: rgb(112, 64, 164);"><strong><span data-contrast="none">truly passionate</span></strong></span><span data-contrast="none"> about their work. If you are amongst them, you can rest assured there is a place for you in eMAG. We’ve grown very fast and are determined to keep doing so. What brought us here is our desire for continuous evolution and practical results. </span><span data-ccp-props="{"134233117":false,"134233118":false,"335551550":6,"335551620":6,"335559738":0,"335559739":0}"> </span></p> <p><span data-contrast="none">More than 6000 colleagues are part of </span><span style="color: rgb(112, 64, 164);"><strong><span data-contrast="none">eMAG Teams</span></strong></span><span data-contrast="none">. We strongly believe in people's development and therefore every year we invest more and more energy and resources to remain an organization that is constantly learning. We want to ensure that you’ll have the most talented colleagues and the proper environment to grow and achieve great results, to become what you desire on a personal and professional level. </span><span style="color: rgb(112, 64, 164);"><strong><span data-contrast="none">Join us, grow faster</span></strong></span><span data-contrast="none"><span style="color: rgb(112, 64, 164);">!</span> </span><span data-ccp-props="{"134233117":false,"134233118":false,"335551550":6,"335551620":6,"335559738":0,"335559739":0}"> </span></p></div><p> </p> <p> </p> <h2 style="text-align: center;"><span style="color: rgb(112, 64, 164);"><strong>IT Risk & Compliance Security Specialist (Cybersecurity & IT Infrastructure Team)</strong></span></h2> <p> </p> <p> </p> <p>The Risk and Compliance Security Specialist will play an important role in implementing and managing the risk and compliance programs related to IT security. This position involves assessing, identifying, and mitigating risks, as well as ensuring the company's IT infrastructure complies with requisite standards and regulations.</p> <p><span style="color: rgb(0, 130, 230);"><strong>What you’ll have to do:</strong></span></p> <p><strong>Governance:</strong></p> <ul> <li>Develop, implement, and maintain a robust IT security program aligned with regulatory and industry standards (ISO 27001, DORA, NIS2, PCI DSS, NIST CSF).</li> <li>Collaborate with senior leadership and business stakeholders to foster awareness of risk and compliance across the organization.</li> <li>Promote best practices and ensure alignment with broader governance objectives.</li> <li>Establish security baselines for both on-premises and cloud-based environments.</li> <li>Create and maintain IT governance policies, including access control, change management, data retention, and business continuity.</li> <li>Develop and maintain an incident response plan, ensuring a structured approach for detecting, containing, and recovering from security breaches.</li> <li>Conduct regular training sessions for employees to raise awareness of IT risk and compliance issues.</li> </ul> <p><strong>Risk Management:</strong></p> <ul> <li>Implement a robust IT risk management framework that supports proactive identification, assessment, mitigation, and monitoring of risks.</li> <li>Regularly review and update the framework to reflect changes in the internal and external environment.</li> <li>Conduct periodic IT risk assessments to identify vulnerabilities, assess potential impacts, and develop mitigation strategies.</li> <li>Collaborate with IT and business units to develop risk mitigation plans and ensure timely implementation.</li> <li>Run the third-party risk management process, including security due diligence for new suppliers, contractual security requirements, and periodic reassessment of critical vendors, in line with NIS2 supply chain security requirements.</li> <li>Manage a risk register, ensuring that identified risks are continuously monitored and addressed.</li> <li>Manage the risk acceptance and policy exception process, ensuring exceptions are documented, approved by the appropriate risk owners, time-bound, and periodically reviewed.</li> </ul> <p><strong>Compliance:</strong></p> <ul> <li>Monitor regulatory changes and ensure organizational compliance with relevant laws and regulations (e.g., GDPR, DORA, NIS2, PCI DSS).</li> <li>Track regulatory requirements across the countries where we operate (Romania, Hungary, Bulgaria), including national NIS2 transpositions, and assess their impact on the organization.</li> <li>Coordinate mandatory incident notifications to competent authorities and national CSIRTs (e.g., DNSC in Romania), ensuring reports are submitted within NIS2 timelines.</li> <li>Coordinate internal and external IT audits, ensuring all compliance requirements are met.</li> <li>Act as the Single Point of Contact (SPOC) for auditors, managing collaboration throughout audit engagements, from information requests and evidence collection to follow-up on findings and remediation actions.</li> <li>Ensure documentation is accurate, up-to-date, and readily accessible for audits and governance reviews.</li> <li>Plan and perform periodic testing of security cont