Senior IT Security & Risk Officer

Work model: Hybrid – 2 days per week in the office. (Wrocław)

Responsibilities

• Conduct security risk assessments of third-party suppliers, products and services, including SaaS, cloud, COTS, hardware and OT solutions.
• Review supplier security documentation, identify risks and non-compliance, and provide risk-based recommendations.
• Collaborate with suppliers and internal stakeholders to address security concerns and ensure compliance with corporate requirements.
• Advise procurement, legal, compliance, business and cybersecurity teams on third-party security risks throughout the supplier lifecycle.
• Improve TPRM processes, assessment methodologies and security governance practices.
• Monitor emerging threats, regulations and industry best practices.

Requirements

• Minimum 5 years of experience in cybersecurity, information security or IT risk management.
• At least 3 years of hands-on experience in third-party security assessments or vendor risk management.
• Strong knowledge of cybersecurity, supply chain security, TPRM methodologies and security control frameworks.
• Familiarity with ISO 27001, NIST CSF, SOC 2, NIS2, DORA and CIS Controls.
• Understanding of AI governance, AI-related risks and the EU AI Act.
• Experience working in large enterprise environments and engaging with external suppliers.
• Strong analytical, problem-solving and communication skills, with excellent English proficiency.

Nice to have

• Certifications such as CISSP, SSCP, CISM, CRISC or equivalent.
• ISO 27001 Lead Auditor or Lead Implementer certification.
• Experience improving security governance and risk management processes.