Third-Party Security Risk Management Specialist

O projekcie We are looking for a cybersecurity professional with strong experience in third-party risk management, security assessments and governance activities. The successful candidate should be comfortable assessing a broad range of technologies and services, working with international suppliers and navigating complex enterprise environments.

Zakres obowiązków

• Third-Party Security Assessments
• Perform security risk assessments of third-party suppliers, products and services, including SaaS solutions, COTS applications, cloud services, hardware and OT-related solutions.
• Review supplier responses, technical documentation, security reports and supporting evidence to assess security posture and identify potential risks.
• Analyze identified risks, address the points of non-compliance, and provide clear, risk-based recommendations.
• Engage directly with suppliers and internal stakeholders to clarify security, compliance and risk-related matters.
• Stakeholder Advisory & Risk Governance
• Act as a trusted advisor on third-party cybersecurity risks throughout supplier onboarding and lifecycle management processes.
• Collaborate with procurement, legal, compliance, business and cybersecurity teams to ensure security requirements are appropriately addressed.
• Ensure assessments align with internal security standards, policies and corporate requirements.
• Process Improvement & Development
• Drive continuous improvement of the Third-Party Risk Management (TPRM) process, methodologies, and assessment practices.
• Identify process gaps, inefficiencies and improvement opportunities, proposing and implementing corrective actions.
• Monitor emerging threats, regulatory requirements and industry best practices to ensure the assessment framework remains effective and up to date.

Wymagania

• Minimum 5 years of professional experience in cybersecurity, information security, IT risk management or related areas.
• Minimum 3 years of hands-on experience performing third-party security assessments, supplier security reviews, technology risk assessments or similar activities.
• Demonstrated experience analyzing technical and security documentation and translating findings into actionable risk decisions.
• Experience working in large enterprise environments with multiple stakeholders and governance processes.
• Experience in collaborating with external suppliers and managing security-related discussions and follow-up activities.

Knowledge & Skills

• Strong understanding of cybersecurity principles and risk management practices.
• Practical knowledge of Third-Party Risk Management (TPRM), supply chain security and vendor risk assessment methodologies.
• Experience assessing security controls against recognized frameworks and standards, including:
• ISO 27001
• NIST Cybersecurity Framework
• SOC 2
• NIS2
• DORA
• CIS Controls
• Understanding of AI governance, AI-related risks and regulatory requirements such as the EU AI Act.
• Experience working with internal corporate security policies, standards and compliance requirements.
• Strong analytical, problem-solving and critical-thinking skills.
• Excellent written and verbal communication skills in English.

Preferred Qualifications

• CISSP, SSCP, CISM, CRISC or equivalent cybersecurity certifications.
• ISO 27001 Lead Auditor, Lead Implementer or similar audit/compliance certifications.
• Experience contributing to the design, implementation or improvement of security governance and risk management processes.