Information Security Advisor - GRC

Responsibilities

• Work with information security, risk management, and regulatory compliance in complex projects
• Develop and improve management systems
• Conduct maturity assessments, risk analyses, and gap analyses
• Provide advice regarding compliance with regulations such as the Security Act, NIS2, DORA, and GDPR
• Bridge security expertise with business understanding in sectors like energy, defense, and healthcare

Requirements

• Bachelor's degree minimum in law, information security, technology, social sciences, or equivalent
• Experience with information security, GRC, risk work, or compliance
• 2–5 years of experience (more for senior roles)
• Knowledge of frameworks like ISO 27001, ISO 27005, NIST SP 800-53, or NSM principles
• Experience implementing and operationalizing management systems
• Understanding of regulations like the Security Act, Personal Data Act, and Digital Security Act
• Strong communication skills in Norwegian (written and oral)
• Ability to obtain or hold security clearance (Secret level or higher)

Preferred Qualifications

• Experience with vendor management or internal auditing
• Experience from regulated sectors or OT environments
• Competence in process management or change management

Benefits

• Engaged professional environment with a culture of knowledge sharing
• Career and development opportunities in a modern consulting environment
• Inclusive workplace with low hierarchy and high trust
• Competitive terms, flexible working hours, and good pension/insurance schemes
• Five weeks of vacation plus paid leave during Christmas and Easter weeks
• Active staff club, social activities, and access to company cabins

About the Company

AFRY delivers services in engineering, design, digitalization, and consulting. We consist of dedicated experts in industry, energy, and infrastructure, creating lasting solutions for future generations.