Hiring: Information Security Specialist (GRC) – Up to 11,000 PLN Gross/Month (Warsaw/Hybrid)

The old Grupa Pracuj Information Security Specialist vacancy, 11,000 PLN pay ceiling and hybrid schedule should not be treated as current. Rebuild it as a maintained guide to GRC, privacy, supplier-risk and information-security careers at Grupa Pracuj, then verify exact openings on the employer’s official channels. Strong evidence covers risk assessment, ISO-aligned controls, third-party assurance, policy, training, privacy and management reporting. Warsaw attendance, language, level and pay depend on the live requisition.

The page must show a visible last verified date and distinguish durable career preparation from volatile vacancy facts. Availability, deadline, location, work model, contract, qualifications, compensation, benefits and application method must be checked again against the exact official notice immediately before publication.

WorkinVirtual should answer first, then help a reader decide. It must identify the organization and geography, explain role families, provide a safe official next step, and state plainly that WorkinVirtual is independent and does not accept applications for the employer.

What readers need to know

The archived Grupa Pracuj listing explicitly identifies itself as expired and described risk procedures, supplier security, reporting, policies, training, ISO 27001 and ISO 27005 knowledge, GDPR context and English. Grupa Pracuj’s current governance page emphasizes data protection, information security, risk management, cybersecurity alignment and resilience across its HR-technology platforms. Those sources support durable occupational intent, not a current vacancy. Candidates should use NIST CSF or current ISO materials to structure evidence while accurately stating whether they implemented, audited, supported or merely studied a control.

Relevant role families include GRC analyst, information security specialist, third-party risk analyst, privacy and security adviser, compliance specialist, security awareness lead and enterprise-risk partner. These are navigation examples, not claims that each role is open. The live requisition controls title, seniority, location, eligibility and work arrangement. Put a direct status statement above any role-family explanation so a mobile reader can answer: Is this current? Am I eligible? What evidence do I need? Where do I apply?

Avoid unsupported superlatives such as “latest,” “best,” “high-paying,” “lucrative” or “guaranteed.” If an official source provides a date, pay range, headcount or program fact, cite it beside the claim and preserve the evidence date. Remove or qualify it when the source changes.

Application steps

1. Check Grupa Pracuj’s current employer and job routes; treat the archived listing only as historical occupational evidence.
2. Confirm exact title, Warsaw location, office frequency, language, level, pay, contract and application destination in a live posting.
3. Build two evidence stories: one risk assessment from scope through treatment and one control or supplier review through remediation.
4. Prepare a sanitized risk register or control matrix using fictional systems and suppliers; separate fact, assumption, rating and decision.
5. Apply through the current official route and retain the posting and confirmation.

Never use a scraped application form as a substitute for the employer. If the official route is unavailable, say so and invite the reader to recheck later. Do not collect sensitive documents merely to measure a conversion.

Skills and evidence

Priority evidence includes risk identification and treatment, control mapping, third-party assessment, policy lifecycle, evidence collection, security reporting, privacy collaboration, contract review, awareness training, stakeholder facilitation and remediation tracking. Use the pattern requirement → context → action → measurable result → proof. Separate personal contribution from team outcomes and state assumptions and limitations.

A useful portfolio is small, relevant and safe. Prefer synthetic, public or explicitly permitted artifacts. Never invent credentials, employment, salary, license, clearance, language fluency or selection probability. Do not expose customer, patient, student, employee, employer, project, security or commercially confidential data.

Engagement design

Provide a GRC evidence matrix for asset or process, threat, impact, likelihood, existing controls, residual risk, treatment, owner and evidence. Add a supplier-risk scenario with privacy, security and contractual questions. Let readers label their experience as led, executed, supported or learned to prevent inflated claims. Include a Polish-English terminology note and a live-posting verification card.

Offer meaningful next steps: official-source click, checklist completion, saved role, resume tailoring, interview-practice prompt and application tracker. Track them only after analytics consent and data-governance approval. Avoid fake countdowns, auto-refreshing vacancy counts, forced registration or quizzes that claim a guaranteed match.

Verification, privacy and safety

Never upload real risk registers, supplier responses, audit findings, contracts, personal data, vulnerabilities or security architecture. Use synthetic cases. Do not claim ISO certification, audit authority or GDPR legal expertise without accurate scope. Verify the recruiter and destination on an official employer-controlled route.

Match the sender domain, requisition, legal entity and destination before replying. Refuse pressure, unofficial payments and requests to move immediately to personal messaging. Share identity or credential documents only through the current official process when genuinely required. The FTC job-scam guide at https://consumer.ftc.gov/articles/job-scams provides general warning signs; local official rules and the employer notice still control.

WorkinVirtual must display an independent-site disclosure, a correction route and an editorial reviewer. When an official source conflicts with a third-party page, the current official source controls. High-risk legal, regulatory, clinical or security claims require a qualified reviewer.

FAQ

Is the 11,000 PLN role current?

No. The retained official listing is marked expired; remove the pay and attendance claims unless a current exact posting supports them.

What does GRC evidence look like?

Show scope, method, stakeholders, controls, treatment, evidence and measurable closure without exposing confidential risk data.

Do I need ISO 27001 knowledge?

The historic listing referenced it, but a current role controls. State whether your experience is implementation, audit support, operation or study.

Is one office day per month still valid?

Not established. Work mode is a current requisition field.

Can I share a real supplier assessment?

No. Create a fictional or permission-cleared example and remove all sensitive data.

Official and primary sources

• Grupa Pracuj — Governance and Digital Security — https://ir.grupapracuj.pl/en/sustainability/governance/
• Pracuj.pl — Expired Grupa Pracuj GRC Listing — https://www.pracuj.pl/praca/specjalista-specjalistka-ds-bezpieczenstwa-informacji-grc-warszawa-prosta-68%2Coferta%2C1003977975
• NIST — Cybersecurity Framework — https://www.nist.gov/cyberframework
• European Commission — Data Protection in the EU — https://commission.europa.eu/law/law-topic/data-protection/data-protection-eu_en
• ISO — Information Security Management Systems — https://www.iso.org/isoiec-27001-information-security.html

These sources establish entity, current verification routes or regulatory context. They do not by themselves prove that the legacy vacancy remains open. Reopen, date-stamp and archive relevant evidence on publication day; remove any claim the source no longer supports.