Risk Manager

Project overview

DIO, through the Felles IKT program, is responsible for establishing a new common ICT platform that will replace DIO's current platforms.

Resources will be part of the Felles IKT program in DIO as a Risk Manager within security.

Description of the Delivery

The Risk Manager shall contribute to strengthening the overall security work in the organization, and has a particular responsibility for establishing mechanisms for, and documenting, assessments, risks, risk acceptance, and other decisions related to Felles IKT.

The resource shall be responsible for:

The Risk Manager shall contribute to ensuring that FIKT has notoriety on security requirements, risk, measures, verification, and documentation of measures, and risk acceptance. The purpose of the work is to have an ongoing updated overview of the security status in Felles IKT, as well as to be able to hand over a holistic description of the security status and a complete risk register to DIO Linje upon completion of the project.

Work Tasks

· Establish processes and structures for security and risk management in FIKT.

· Keep the risk register continuously updated

o Document risk assessments, recommended measures, and decided measures, as well as compensating measures and residual risk.

· Facilitate and contribute to risk assessments carried out in sub-projects or centrally in the project.

· Document measures to meet security requirements in accordance with requirements and methodology for requirements traceability and documentation.

· Prepare decision bases for measures and risk acceptance.

Competence Requirements

· Experience in establishing security management, risk assessments, risk register, requirements traceability, and measure development in complex organizations

· Experience with security assessments/maturity assessments of digital security against defined requirements specification

· Experience with digital security frameworks such as ISO27001, NIST CSF, NSM's basic principles for ICT security, the Security Act

· Experience with security requirements for technical teams

· Experience with pedagogical compilation of risk information

The consultant must be able to be security cleared for SECRET.

· A security agreement must be entered into between the consultant's company and the program.

· Content/tasks in the assistance may be changed as needed.

Senior Advisor

Resource with more than 8 years of experience within the tasks specified for the ICT field.

Minimum formal competence is a Master's degree or equivalent in the ICT field.

Long and documented experience can compensate for the requirement of a Master's degree.

Project details

900 (80% position) from ASAP - 30.06.2027, option for extension

Oslo

Internal application deadline: 16.11 at 12:00

Contact by email for competence matrix.

• Start: flexible
• Duration: 4-6 months
• Remote: onsite
• Location: Oslo, Norway, NO
• Languages: Norwegian