Operational Risk assessment Analyst

Job Title: Operational Risk assessment Analyst

Location: Krakow, Poland (Hybrid - 3 days in a week to onsite)

Job Type: B2B Contract

Job Description

Your role

You will be responsible for evaluating the security posture of third-party vendors that have access to sensitive information or systems of. You will conduct risk assessments to identify and evaluate potential security threats posed by third-party vendors and recommend risk mitigation strategies to minimize the organization's exposure to cyber threats. You will also work closely with internal stakeholders to ensure that third-party vendors comply with our cybersecurity policies and procedures.

We are looking for candidates who have experience in the following areas:

• Conduct risk assessments of third-party vendors to identify potential security threats and vulnerabilities;
• Reporting regular updates to relevant committees and management teams on the status of 3rd party Cybersecurity risk and compliance issues based on internal/external & regulatory assessment results
• Ensure that 3rd party Cybersecurity risk assurance approach, plans and execution are aligned with standard operating policies and procedures, risk assurance standards and regulatory requirements
• Analyze and evaluate vendor security controls, policies, and procedures to ensure compliance with regulatory requirements and industry best practices;
• Develop and implement risk mitigation strategies to address identified vulnerabilities and reduce the organization's exposure to cyber threats;
• Communicate assessment findings and recommendations to internal stakeholders, including senior management, legal, and compliance teams;
• Monitor and track vendor compliance with security policies and procedures through cyclical/periodic assessment activities;
• You’ll be working in the CISO/OCRA (Operational Consolidate Risk assessment) team in Poland. You'll take a part in supporting colleagues from different areas of the firm, including Risk Taxonomy Owners, Compliance & Operational Risk Controllers and Outsourcing & Supplier Management, in improving the overall risk assessment process and implementing the most effective remediation measures.

You have

• Knowledge in regulatory guidelines and requirements: FRBNY, FINMA, MAS, HKMA, DORA etc.
• Knowledge and specialist in 3rd to Nth party security risk oversight and assessment
• Knowledge on internal / external and regulator engagements
• Cyber and Information security or data privacy related certifications (e.g. CISSP, CISM, CISA or CRISC) are an advantage.
• Ability to communicate both written and verbal for business key partners and management audience. Excellent negotiation, influencing and analytical skills are highly desired
• Knowledge in NIST Cybersecurity Framework and NIST 800 series documents and other such related frameworks: COBIT/ITIL/ISO
• Information Security audit or risk assessment experience in complex IT environments, including Cloud technologies would be beneficial.
• Proven ability to work both independently and as part of a team to deliver quality work in a fast-paced environment
• Flexibility and ability to think creatively and to identify new ways to approach old problems
• Phenomenal analytical, decision-making, and problem-solving skills
• Dedication to fostering an inclusive culture and value varied perspectives.
• 5+ years of experience in third-party risk assessment or cybersecurity assessment;
• Certifications such as Certified Third-Party Risk Professional (CTPRP) or Certified Information Systems Security Professional (CISSP) are a plus.