IT Security Risk Specialist (Third-Party)

About the Project & Role

We are representing a top-tier, global financial institution that heavily invests in modern technology, cloud-native solutions, and advanced Artificial Intelligence to drive its business decisions.

Currently, the company is expanding its structures in Poland and is looking for the first person in the Warsaw office to join a 9-person, global Technology Governance and Risk Management team (reporting directly to the Head of the team, rolling up to the CISO).

We are looking for a highly technical Subject Matter Expert (SME) who will take the wheel in the area of third-party security risk management. This is not a compliance role focused on clicking through Excel spreadsheets. You will be technically x-raying architectures, analyzing penetration test results, and verifying whether cloud solutions and AI tools provided by external vendors are secure enough for a multi-billion-dollar business.

What you will do (Responsibilities)

• Technical Assessments: Perform in-depth, hands-on security assessments of new and existing third parties, with a strong focus on Cloud and SaaS environments.
• Architecture & Evidence Review: Analyze data flows, system integrations, assurance reports (SOC 2, ISO 27001), penetration test results, and vulnerability scans.
• Security Control Evaluation: Assess a wide spectrum of domains, including IAM, Network Security, Vulnerability Management, Data Protection, and AppSec.
• Challenging & Validating: Engage directly with external vendors' engineering teams to validate their security assertions, investigate gaps, and evaluate remediation plans.
• Reporting & Collaboration: Produce concise, risk-based reports and partner with Technology, Compliance, Legal, and Procurement teams.

What we require (Must-have)

• Experience: 5+ years in Information Security, Technology Risk, Security Engineering, Security Architecture, or technical TPRM.
• Hands-on Assessment Skills: Proven experience in independently conducting technical security assessments of third-party environments.
• Higher Education: A Bachelor’s degree (or higher) in IT, Information Security, or a related field is a strict requirement.
• Broad Technical Knowledge: Strong understanding of Cloud (SaaS/IaaS), IAM, network security, data protection, and incident response.
• AI Exposure (Crucial!): The company is highly focused on Artificial Intelligence. You must have practical experience or a strong understanding of assessing AI/GenAI vendor solutions or utilizing AI tools in your daily work.
• Standards & Frameworks: Familiarity with NIST CSF, NIST 800-53, ISO 27001, and/or SOC 2.
• Analytical Independence: The ability to critically analyze technical evidence and confidently challenge third-party assertions.

Nice-to-have

• Previous experience in the financial / banking sector.
• Familiarity with TPRM platforms (e.g., OneTrust, ServiceNow, SIG).
• Industry-recognized security certifications (e.g., CISSP, CISM, CISA, CCSP).

What we offer

• Direct impact on the security posture of a global financial firm (you will be the pioneer for this role in Poland).
• Straightforward recruitment process (4 stages: Hiring Manager -> 2-3 technical team interviews -> Sr. Manager).
• Candidates with a 3-month notice period are welcome.