Operational Risk assessment Analyst

Project overview

This contract role sits in the CISO/OCRA team in Poland and focuses on assessing cybersecurity risks from third-party and nth-party vendors with access to sensitive information or systems. The core requirements are at least five years of third-party or cybersecurity assessment experience, the ability to assess vendor controls and compliance, and the ability to recommend remediation and communicate findings to stakeholders and management.

Familiarity with regulatory guidance and frameworks such as NIST, ISO, COBIT, and DORA is relevant; security and risk certifications and cloud assessment experience are advantages. The description calls for strong written and spoken English, analytical skills, and effective stakeholder communication. The structured location is Krakow and the employment type is contract; work mode is not specified. The given title emphasizes operational risk, while the duties are specifically focused on third-party cybersecurity risk assessment.

Responsibilities

• Knowledge in regulatory guidelines and requirements: FRBNY, FINMA, MAS, HKMA, DORA etc.
• Knowledge and specialist in 3rd to Nth party security risk oversight and assessment
• Knowledge on internal / external and regulator engagements
• Cyber and Information security or data privacy related certifications (e.g. CISSP, CISM, CISA or CRISC) are an advantage.
• Ability to communicate both written and verbal for business key partners and management audience. Excellent negotiation, influencing and analytical skills are highly desired
• Knowledge in NIST Cybersecurity Framework and NIST 800 series documents and other such related frameworks: COBIT/ITIL/ISO
• Information Security audit or risk assessment experience in complex IT environments, including Cloud technologies would be beneficial.
• Proven ability to work both independently and as part of a team to deliver quality work in a fast-paced environment
• Flexibility and ability to think creatively and to identify new ways to approach old problems
• Phenomenal analytical, decision-making, and problem-solving skills
• Dedication to fostering an inclusive culture and value varied perspectives.
• 5+ years of experience in third-party risk assessment or cybersecurity assessment;

Requirements

• At least five years of third-party risk assessment or cybersecurity assessment experience
• Third-party and nth-party cybersecurity risk oversight and assessment
• Assessment of vendor security controls, policies, procedures, and compliance
• Knowledge of applicable regulatory requirements and guidelines, including those listed in the description
• Knowledge of cybersecurity and risk frameworks, including NIST Cybersecurity Framework and NIST 800-series documents
• Development or recommendation of risk mitigation and remediation measures
• Assessment reporting and communication with internal stakeholders, committees, and management
• Strong written and spoken English

Project details

• Start: flexible
• Remote: hybrid
• Location: Poland, PL
• Languages: English