Information Security & Compliance Consultant

Roboyo AI is a category shaper in Applied AI and Agentic Automation.  We help leading enterprises move from automation projects and AI experiments into governed, production-grade systems that execute real work across workflows, processes, products and services. 

Our heritage is in scaled enterprise automation; our future is Applied AI and Agentic Automation: autonomous agents, AI engineering squads, process orchestration, data and knowledge foundations, and human-in-the-loop governance embedded deeply into how our clients operate. 

We are not here to sell AI theatre. We are here to turn AI into working systems, measurable outcomes and repeatable transformation programs. 

ABOUT THE ROLE

We are looking for an Information Security & Compliance Consultant to manage and deliver client projects in the areas of information security, cybersecurity, data protection and regulatory compliance.

The successful candidate will take ownership of a portfolio of clients and projects, supporting organisations in the implementation, maintenance and continuous improvement of ISO/IEC 27001 Information Security Management Systems (ISMS) and in their compliance with regulatory frameworks including NIS2, DORA and GDPR.

The role combines strong technical and regulatory knowledge with hands-on consulting, audit preparation, risk management and client relationship management. The consultant will also contribute to the maintenance and continuous improvement of Roboyo's internal management systems.

MAIN RESPONSIBILITIES

• Lead the implementation, maintenance and continuous improvement of ISO/IEC 27001 Information Security Management Systems (ISMS) for clients.

• Perform ISO 27001 gap assessments, readiness assessments and support organisations throughout certification and surveillance audit processes

• Support organisations in assessing and implementing requirements arising from NIS2, including governance, cybersecurity risk management measures, incident management, business continuity, supply-chain security and compliance monitoring.

• Support financial-sector clients and ICT service providers with DORA compliance, including ICT risk management, incident management, operational resilience and ICT third-party risk.

• Provide GDPR/data protection advisory services, including privacy governance, risk assessments, policies, procedures and, where applicable, DPO services.

• Conduct and coordinate information security risk assessments, supporting the definition and monitoring of risk treatment plans.
• Develop, review and maintain information security and compliance documentation, including policies, procedures, risk registers, Statements of Applicability and supporting evidence.
• Coordinate and/or perform internal ISO 27001 audits and support external certification audits.
• Coordinate activities with certification bodies, auditors, customers and specialised cybersecurity providers.
• Support customers in establishing and improving third-party/supplier security and due diligence processes.
• Support incident management, business continuity and information security governance activities.
• Identify compliance gaps and define pragmatic remediation plans with customers.
• Manage multiple customer engagements, including project planning, deliverables, service hours and agreed milestones.
• Participate in customer meetings, workshops, presentations and demonstrations of consulting services and compliance solutions.
• Contribute to commercial activities, including demos, explore meetings, scope definition, effort estimation and preparation of proposals for information security and compliance project

MANDATORY REQUIREMENTS 

• Higher education in Information Security, Cybersecurity, Information Systems, Engineering, Management, Law or a related field.

• Proven hands-on experience implementing and/or maintaining ISO/IEC 27001 ISMS.

• Practical knowledge of ISO/IEC 27001:2022 requirements and information security risk management.

• Demonstrable knowledge and project experience related to NIS2 requirements and cybersecurity governance.

• Strong knowledge of GDPR and data protection principles.
• Knowledge of DORA and ICT risk/compliance requirements.
• Experience preparing organisations for internal, certification and/or surveillance audits.
• Ability to develop information security policies, procedures, risk assessments and compliance documentation.
• Strong customer-facing and stakeholder-management skills.
• Ability to manage multiple customers and projects independently.
• Good written and verbal communication skills in Portuguese and English.

CERTIFICATION

At least one of the following certifications, or equivalent recognised certification:

• ISO/IEC 27001 Lead Implementer
• ISO/IEC 27001 Lead Auditor

Candidates holding both Lead Implementer and Lead Auditor certifications will be strongly preferred.

VALUED REQUIREMENTS

• Both ISO/IEC 27001 Lead Implementer and Lead Auditor certifications.

• DPO / Data Protection certification.

• Additional information security or risk certifications.

• Experience with ISO/IEC 27701 Privacy Information Management Systems.

• Experience with other management system standards, particularly ISO 9001, ISO 22301, ISO 37001 or ISO 13485.

• Experience with third-party risk management, supplier assessments and due diligence.

• Experience with business continuity, incident response and operational resilience.

• Experience coordinating penetration testing, vulnerability assessments or other cybersecurity assurance activities with specialist providers.

• Previous consulting experience and responsibility for managing a portfolio of customers.

• Experience preparing commercial proposals and estimating information security/compliance projects.

BEHAVIOURAL PROFILE

• Autonomous and accountable, able to take ownership of client engagements from assessment through implementation and audit.

• Strong organisational skills and ability to manage multiple clients, priorities and deadlines simultaneously.

• Analytical mindset with strong attention to detail.

• Ability to translate complex regulatory and technical requirements into practical actions for customers.

• Proactive approach to identifying risks, compliance gaps and improvement opportunities.

• Strong written and verbal communication skills, particularly in customer-facing environments.

• Comfortable facilitating workshops and interacting with management, technical teams, auditors and external partners.

• Pragmatic and solution-oriented approach to compliance.

• Strong team spirit and willingness to collaborate with internal and external specialists.

We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.

Privacy Notice: By applying, you consent to the processing of your personal data for recruitment purposes in line with our Privacy Policy: https://roboyo.global/data-privacy/