IT & Cyber Third Party Risk Assessor

Community Consulting; Brussel Hoofdstad; Hybrid; EUR 90,000 - 150,000; Full time

Job summary

Community Consulting in Belgium is seeking an experienced IT & Cyber Third-Party Risk Assessor to evaluate and monitor risks from intragroup and external suppliers, especially cloud-based services. You will lead risk assessments, challenge contract clauses and coordinate audits to ensure regulatory compliance.

The role requires deep expertise in risk management frameworks and strong collaboration with Procurement, Legal and Business teams.

Qualifications

• Minimum 10 years of experience in Information Security and IT risk management.
• Extensive experience with third-party security risk assessments.
• Proven cloud security experience across SaaS, IaaS and PaaS.
• Experience with application security, vulnerability management and pentesting.
• Familiar with ISO27001, SOC, NIST and OWASP.
• Experience in Financial Services and large corporate environments.
• Experience negotiating IT and cyber third-party contracts.
• Master's degree in a relevant field.
• Fluent French; Dutch is a plus.

Responsibilities

• Conduct comprehensive IT and cyber risk assessments of intragroup and external suppliers during due diligence.
• Evaluate suppliers’ cybersecurity posture, IT controls and regulatory compliance.
• Assess cloud-based solutions with focus on security, data protection and resilience.
• Review vulnerability assessments and penetration testing reports.
• Review and negotiate IT and cybersecurity clauses in supplier contracts.
• Collaborate with Procurement, Legal and Business teams to mitigate risk in contracts.
• Coordinate IT and Cyber onsite audits performed by external auditors.
• Review audit reports, validate findings and monitor remediation plans.
• Escalate critical IT and cyber risks and support timely resolution.
• Develop ICT risk dashboards and management reports.

Skills

Information Security

Third-party risk

Cloud security

Vulnerability management

Penetration testing

Risk frameworks

Contractual risk

Cross-functional collaboration

Stakeholder communication

Analytical thinking

Education

Master's degree in IT / Cybersecurity / Risk Management

Tools

ServiceNow GRC

Job description

The Governance, Risk and Compliance team is responsible for ensuring robust IT and Cyber Risk Management across a large financial services organization, with a strong focus on Third-Party Technology Risk Management (TPTRM). As an IT & Cyber Third Party Risk Assessor, you will assess, mitigate and monitor cybersecurity and operational risks associated with intragroup and external suppliers, particularly cloud-based solutions, while ensuring compliance with internal IT and Information Security policies.

Responsibilities

• Conduct comprehensive IT and Cyber risk assessments of intragroup and external third-party suppliers during due diligence.
• Evaluate suppliers’ cybersecurity posture, IT controls and compliance with regulatory and contractual requirements.
• Assess cloud-based solutions, including SaaS, hosting services and AWS environments, with a focus on security, data protection and resilience.
• Review vulnerability assessments and penetration testing reports.
• Review, challenge and negotiate IT and cybersecurity clauses in supplier contracts.
• Collaborate with Procurement, Legal and Business teams to integrate appropriate risk mitigation measures into contracts.
• Coordinate IT and Cyber onsite audits performed by external auditors.
• Review audit reports, validate findings and monitor supplier remediation plans.
• Escalate critical IT and Cyber risks and support their timely resolution.
• Perform continuous monitoring of third-party IT and security posture.
• Review security reports, incident responses and compliance attestations such as ISO 27001, SOC and NIST.
• Lead ICT Risk and Cyber Committees with internal stakeholders and supplier security teams.
• Develop ICT risk dashboards and management reports highlighting risks, trends and recommendations.
• Collaborate with Cyber Defense, Security Architecture, Business Continuity, Data Protection, Procurement and Legal teams.
• Contribute to the continuous improvement of TPTRM frameworks, tools and methodologies.
• Develop and refine ICT risk assessment templates, audit guidelines and reporting standards for expert and non-expert audiences.

Technical skills

Must have

• 10+ years of professional experience in Information Security and IT & Cyber Risk Management.
• Strong experience in third-party IT and security risk assessments.
• Strong experience with cloud security across SaaS, IaaS and PaaS environments.
• Experience with application security, vulnerability management and penetration testing.
• Proficiency with Information Security and Risk Management frameworks, including ISO 27001, SOC, NIST and OWASP.
• Experience in IT risk management and audit methodologies.
• Professional experience within Financial Services and large corporate environments.
• Experience reviewing and amending IT and Cyber third-party contractual clauses.
• Experience in process design and business analysis related to IT and security risk management.
• Experience delivering presentations and training to stakeholders.
• Strong IT background with exposure to operational and security risk management.
• Master’s degree in IT, Cybersecurity, Risk Management, or equivalent professional experience.
• Fluent French.
• Strong analytical and synthesis capabilities.
• Excellent communication and influencing skills.
• Ability to work autonomously and manage multiple priorities.
• Strong negotiation and conflict-resolution capabilities.
• Ability to engage effectively with technical, business and supplier stakeholders.

Should have

• Fluent Dutch.
• Strong knowledge of control frameworks and audit methodologies.
• Ability to mentor and coach colleagues.
• Ability to operate effectively in a dynamic and multicultural environment.
• Ability to adapt to stakeholder expectations while respecting established processes.

Nice to have

• CISSP, CISM, CIPP, CCSK or similar security certification.
• Familiarity with ServiceNow GRC.

Who we are

Community Consulting goes beyond traditional consulting; it’s all about fostering connections in an atmosphere of trust and confidence.
Transparency & Honesty : We say things as they are. Clear communication for seamless collaboration.
#COMMUNITEAM : Work independently, but never alone. Collective intelligence drives us further, faster.
Total Commitment : Always present, always engaged. We find solutions and make sure everyone moves forward together.
Guaranteed Efficiency : No fluff, just results. We act fast, keep our promises, and deliver top quality.
This is our DNA. This is how we make a difference.