Senior Consultant NIS2 Cyber Governance Risk and Compliance

Job Title: Senior Consultant – NIS2 Cyber Governance, Risk & Compliance

Location: Dublin 2, Ireland; client office is the contractual home base.

Start Date: Anticipated November 2026 or as soon as possible thereafter, subject to award and confirmation.

Contract Duration: Anticipated 12 months plus up to two optional six-month extensions; duration units await client confirmation.

Hybrid / Onsite / Remote: Required on-site attendance and any hybrid or remote arrangement are to be confirmed.

Grade and Experience: Level 3 Senior Consultant; typically more than three years as a professional consultant, with specialist expertise and project/team management experience.

Grade experience is indicative, rather than a separate minimum-years pass/fail threshold.

Client Overview

An Irish central government organisation is operationalising NIS2-aligned cybersecurity governance, risk and compliance following a gap analysis. Its existing eramba GRC platform requires configuration, integration and embedding; platform selection is outside scope.

Role Overview

Lead governance, cyber risk, incident response, compliance, assurance and audit readiness. Combine strategic advice with hands-on delivery, oversee the Consultant’s platform work and lead stakeholder engagement and knowledge transfer.

Mandatory Requirements and Experience

Candidates must meet the following role-specific sourcing requirements. These support the team’s overall capability and are not a statement that every item is an individual tender pass/fail test.

·         Proven NIS2 implementation or equivalent ISO/IEC 27001 / NIST CSF delivery.

·         Strong cyber GRC capability: governance, risk, control design/testing, assurance and audit readiness.

·         Comparable public-sector or regulated-environment engagements.

·         Strategic advice and hands-on implementation; GRC platform delivery oversight; client-facing project and stakeholder leadership.

Availability

Confirm earliest start, available days, planned absences and ability to attend Dublin as agreed. Named personnel must remain available for the agreed term. Actual workload is unconfirmed; engagement is subject to contract award and client approval.

Qualifications

No specific degree or certification is mandatory. Relevant qualifications and training are desirable. CISSP, CISM, CRISC, CGEIT, ISO 27001 Lead Implementer/Auditor or relevant NIS2 training; IMCA Member-level or similar accreditation is desirable.

English Language Proficiency

Fluent spoken and written English for workshops, stakeholder communication, reporting, documentation and training. This is a recruitment expectation; no specific language test or score is prescribed.

Key Deliverables

·         Operational governance structures, roles, reporting lines, decision forums and escalation paths.

·         Cyber risk processes embedded within enterprise risk management, including risk methodology, ownership and treatment oversight.

·         Incident response procedures, playbooks and tested capabilities aligned with reporting obligations.

·         NIS2 control framework, control ownership, testing methods, evidence standards and requirements-to-evidence traceability.

·         Assurance dashboards and reporting, audit-readiness documentation and quality assurance of platform outputs.

·         Delivery plan, milestones, risks/issues, dependencies, change control and stakeholder reporting.

·         Training materials, structured knowledge transfer and operational handover enabling independent client operation.

Key Experience Competencies and Skillsets

Risk and control assessment; consulting and analytical methods; workshop facilitation; clear executive reporting; stakeholder and delivery leadership. GRC platform implementation knowledge is essential; hands-on eramba experience is desirable.

Engagement and Working Arrangements

Working days and full-time/part-time commitment are to be confirmed. The 100 notional days per grade are for evaluation only and do not establish actual days or a two-day-per-week schedule. Extension workloads are also unconfirmed. One working day is 7.5 hours; part days are pro rata. Travel beyond the home base requires prior approval. Candidate daily rates are agreed separately.