Cybersecurity Risk & Compliance Consultant (NIST CSF)

O projekcie

• For our Client from banking industry we are looking for Cybersecurity Risk & Compliance Consultant (NIST CSF)

Working model: Warsaw, Łódź, Gdynia, and Gdańsk, with a preference for the Tricity area. The role requires working from the office three days per week.

The consultants are expected to perform a NIST CSF Maturity Assessment in collaboration with the client's representatives. The assessment was last conducted in 2026, utilising the NIST Framework. The work will therefore revolve around reassessing the previous ratings through workshops with relevant stakeholders, while ensuring valid comparisons and maintaining a future-proof and up-to-date assessment approach.

Zakres obowiązków

• Review and update the existing NIST Assessment "workbook" for data collection, ensuring it is both comparative/backwards compatible and future-proof for subsequent assessments.
• Take part in planning workshops.
• Conduct kick-off meetings with relevant stakeholders.
• Conduct workshops/meetings with relevant stakeholders (approximately 70 stakeholders) via Microsoft Teams and document the input/data gathered.
• Analyse and process workshop data and justify the updated ratings (including reviews and potential calibrations).Produce and present a technical results report and an executive report.

Wymagania

• Have professional English spoken & written skills;
• Have a solid understanding of Information Security and Risk Management processes including industry practices within Information Security;
• Have experience with conducting NIST CSF maturity assessments;
• ave experience working with similar maturity assessments within FSI;
• Preferably hold relevant Information Security, Risk and Business Continuity Management certifications such as CISM, ISO27x, ISO22301 etc;
• Preferably have minimum 5 years of experience in Information Security domain;
• Be proactive, flexible, independent and pragmatic team-players with a solution-oriented mindset;
• Be able to communicate in a constructive manner with all levels of the organisation;
• Be structured, analytical and have a high ability to provide timely and accurate Information Security reporting;
• Be able to focus on information value and making complex data understandable for a non-technical audience.