Cyber Strategy and Resilience Senior Associate

Job Description & Summary Build trust and resilience in a changing cyber landscape A career with the PwC CEE Cyber Practice will give you the opportunity to join a 200+ strong team of cybersecurity professionals across Central and Eastern Europe. Within our Strategy and Resilience tower, you will help clients set cyber direction, assess risk and regulatory readiness, strengthen governance and build organisational resilience. You will collaborate with specialists from our Enterprise and Cloud, Digital Identity and Offensive Security towers when engagements require broader technical expertise. We are looking for a Cyber Strategy, Risk and Resilience Senior Associate based in Croatia. You will deliver consulting work for clients across CEE and remotely support engagements in the rest of Europe, the United States and the Middle East. Occasional business travel may be required. You will work with multidisciplinary PwC teams and client stakeholders, turning complex regulatory, risk and resilience questions into practical, management-ready advice. What you will do Assess cybersecurity and information security controls against relevant EU legislation, including NIS2, DORA and the Cyber Resilience Act, as well as applicable national regulatory requirements. Map regulatory and framework requirements to client controls and evidence, validate whether the evidence supports the stated conclusion, and critically review any AI-assisted analysis before it is used in client work. Identify compliance gaps, control weaknesses and practical opportunities for improvement. Produce traceable, management-ready findings, recommendations and deliverables that reconcile authoritative requirements with client evidence and provide a robust first quality filter before Manager or Partner review. Support the development and implementation of cybersecurity governance, risk and compliance frameworks, policies and procedures. Support cyber strategy and resilience engagements, including strategies and roadmaps, maturity assessments, governance and operating models, policy development, remediation planning, third-party risk, business continuity and crisis management. Use approved enterprise AI tools where appropriate to accelerate research, mapping and document review; critically evaluate the output, verify conclusions against authoritative sources and client evidence, and flag unsupported conclusions or issues requiring legal or specialist input. Plan and deliver workstreams in collaboration with multidisciplinary and multi-territory teams. Review junior colleagues’ work, support their development and help coordinate day-to-day delivery. What you bring A university degree in ICT, information systems, computer science, information or cybersecurity, or a related discipline. 3-5 years of relevant experience in cyber consulting, cyber risk, governance, resilience, technology risk, IT audit, internal controls or regulatory compliance, with experience delivering work at Senior Associate or equivalent level. Strong working knowledge of cyber risk, governance and resilience requirements, with the ability to interpret and reconcile regulations and frameworks such as NIS2, DORA, the Cyber Resilience Act, ISO/IEC 27001 and NIST CSF. Ability to distinguish organisational obligations from product-security duties and identify when legal or specialist input is required. Hands-on experience in regulatory gap assessments and risk or control reviews, together with experience in at least one of the following: cyber strategy or roadmaps; maturity assessments; governance or target operating models; third-party risk management; business continuity or crisis management; operational resilience; or remediation planning. Ability to independently validate evidence, map requirements and controls, and draft client-ready deliverables. Strong report-writing skills and the ability to express complex issues clearly, concisely and accurately. Professional proficiency in written and spoken Croatian and English is essential. Strong critical thinking, intellectual curiosity and attention to detail, with the ability to organise work, manage priorities and deadlines, monitor progress, and communicate delivery risks or issues promptly. Ability to work independently and collaborate effectively with international, multidisciplinary teams across different territories and cultures. You will contribute strategy, risk and resilience expertise while drawing on specialists from other cyber towers for architecture, identity and offensive-security matters. Practical understanding of cybersecurity risk management, including risk identification, analysis, treatment and monitoring. Additional advantages Experience in consulting, assurance, internal audit, compliance or another client-facing environment. Experience working with recognised cybersecurity frameworks and standards, such as ISO/IEC 27001, NIST CSF, SOC 2 or related control frameworks. A relevant professional certification is an advantage but is not required. The most applicable credentials include CISM, CRISC, CISA, CISSP, ISO/IEC 27001 Lead Implementer or Lead Auditor, and ISO 22301 Lead Implementer or Lead Auditor or CBCI/CBCP. Knowledge of Croatian cybersecurity or sector-specific regulatory requirements. What you will get Interesting international projects across CEE, wider Europe and the broader EMEA region. Collaboration with and learning from leading cybersecurity specialists and multidisciplinary teams across the PwC network. Structured learning, company training and strong opportunities for professional and career development. Access to PwC network knowledge, methodologies, technologies and tools. A supportive, adaptable and team-oriented working environment. Competitive compensation and a comprehensive benefits package. Exposure to varied clients, sectors and regulatory environments. Who should apply If you are an experienced cyber risk, governance or resilience consultant with sound regulatory judgement, critical thinking and clear communication, we would like to hear from you. This Senior Associate role requires you to independently validate evidence, synthesise complex requirements and produce client-ready work while knowing when to involve legal, technical or other specialist colleagues. Start your journey at PwC by applying by 6.12.2026. Your application will be treated with full confidentiality. Only shortlisted candidates will be contacted. Privacy Statement