Senior GRC & Regulatory Compliance Consultant (NIS2/CSL)

Cyber Instincts is a Gothenburg-based cybersecurity consultancy helping organizations build digital resilience across IT, OT, and automotive environments. We work with clients across automotive, manufacturing, banking and finance, retail, and healthcare - including public sector organizations navigating new cybersecurity legislation. We're building our senior bench for governance, risk, and compliance engagements centered on Sweden's Cybersäkerhetslag (CSL) and NIS2, with a particular focus on clients in municipal, regional, and public administration contexts.

What the work looks like:

• Conducting gap analyses between clients' current practices and CSL/NIS2 requirements
• Translating legislation into concrete, actionable roadmaps - not theoretical reports
• Supporting governance, risk management, and incident reporting processes required under CSL
• Assessing third-party and supply chain risk, including vendor and subcontractor dependencies
• Integrating cybersecurity compliance work with existing information security, data protection, and continuity functions
• Supporting procurement processes where cybersecurity requirements need to be defined or clarified in contracts and agreements
• Presenting findings and recommendations to steering groups, management, and non-technical stakeholders

What you'll bring:

• 8+ years of experience in governance, risk & compliance, information security, or IT risk management
• Documented, current knowledge of NIS2 and Swedish cybersecurity legislation (CSL)
• Solid grounding in ISO 27001, NIST, or COBIT frameworks
• Proven reference engagements with Swedish municipalities, regions, or government agencies- this is essential, not preferred
• Experience conducting GAP and risk analyses and turning them into concrete, auditable requirements
• Fluent Swedish and English, spoken and written - you'll be presenting directly to Swedish public sector stakeholders

A plus, not a requirement:

• Experience with public procurement (LOU) or framework agreements
• Background in critical infrastructure or samhällsviktig verksamhet
• Incident reporting process design experience

This is a Sweden-based, on-site role with placements at client sites across the country. Applicants must currently reside in Sweden. You'll be employed or engaged on a freelance basis and placed directly with our clients for the duration of each engagement.