Compliance Analyst - Lisbon/Hybrid

• Relevant professional experience (implementation and/or execution of Cybersecurity/Information Security risk management programs) of at least 2 years.
• Basic knowledge of Risk & Compliance frameworks.
• Knowledge of relevant standards in the field of Cybersecurity and Information Security (e.g., ISO 27001, NIST CSF).
• Knowledge of Information Technologies (e.g., information systems management, application platforms, software development).
• Knowledge or experience in document management, compliance evidence, and executive reporting.
• Experience in regulatory analysis.

• Bachelor's or Master's degree (preferred) in Law, Management, Information Technologies (e.g., Computer Science, Electrical Engineering, Telecommunications, Cybersecurity, Information Systems Management), or an equivalent field.
• Experience in Risk Management, from a legal compliance perspective, for NIS Directives, GDPR, and civil aviation legislation.
• Participation in audits or compliance assessments.
• Experience and/or knowledge of GRC tools and risk registers.
• Complementary training in Compliance, Data Protection, or Information Security.
• Interest in aeronautical regulation and operational risk.

• Fluent Portuguese and advanced English (spoken and written at least level B2).

Preferred requirements (not mandatory):

• Monitor legal, regulatory, and normative requirements applicable to Cybersecurity, Information Security, Data Protection, and Digital Resilience.
• Support the interpretation and operationalization of compliance requirements, including NIS2, EASA PART-IS, GDPR, NIST CSF, ISO/IEC 27001, and other applicable frameworks.
• Perform regulatory compliance assessments, gap assessments, and compliance matrices, ensuring the identification of deviations, the provision of evidence, and mitigation action plans for the identified issues.
• Ensure the recording and updating of compliance matrices, applicable requirements, associated controls, and respective documentary traceability.
• Support Change Management processes, ensuring the provision of evidence.
• Support internal and external audits, regulatory inspections, and independent assessments, ensuring their preparation, evidence collection, and follow-up.
• Monitor action and mitigation plans resulting from audits, inspections, compliance assessments, or regulatory changes.
• Support the review and updating of internal Information Security and Cybersecurity policies, procedures, rules, and standards.
• Support contractual negotiations with suppliers regarding Information Security, ensuring that agreed clauses respect regulatory scopes.
• Consolidate compliance information and produce periodic reports for management, audits, and regulatory entities.
• Track legal and regulatory changes, assessing impacts and promoting coordination with the areas responsible for their implementation and management.
• Interact with internal and external stakeholders to promote the consistent implementation of compliance requirements.

Working arrangement: hybrid model, with an expected presence at the client site 2 to 3 days per week. The model allows for some flexibility in the distribution of in-person days; depending on project needs, there may be weeks with greater presence (more days, e.g., 4/5 days) and others where only 1 day at the client is required.

Noesis is looking for professionals with the following profile: