Risk Assessment Analyst

Sentior, Ltd.; Kolding; Hybrid; DKK 900,000 - 1,200,000; Full time

Job summary

Vattenfall in Kolding seeks a Senior OT Risk Assessment Analyst to identify and assess operational and security risks across complex industrial environments. The role focuses on translating risks into security requirements and treatments, leveraging IEC 62443 and ISO/IEC 27001-family standards, and coordinating with asset owners.

You will lead workshops, evaluate threats and vulnerabilities, and create a portfolio-level OT risk view to support risk-based decision making.

Qualifications

• Strong practical OT/ICS security and industrial risk-assessment experience.
• Experience with IEC 62443, ISO/IEC 27001-family risk management, IEC 62443-3-2.
• Experience applying risk-management principles in industrial/OT environments.
• Education in Cyber Security, Automation/Control/Electrical/Industrial Engineering or Risk Management.
• Relevant certifications: GICSP, CISSP, CISM, CRISC.

Responsibilities

• Plan, structure and drive end-to-end OT cyber and operational risk assessments across complex industrial environments.
• Apply IEC 62443 standards and translate risks into security requirements and treatments.
• Assess asset/system criticality, threats, vulnerabilities, and risk treatments.
• Lead risk-identification workshops with Engineering, Operations and Security teams.
• Consolidate findings into portfolio-level OT risk picture and drive risk-management processes.

Skills

OT/ICS security

Industrial risk assessment

IEC 62443

ISO/IEC 27001/27005

Risk management

Energy/Utilities experience

GICSP/CISSP/CISM/CRISC

English fluency

Industrial networks

Education

BSc/MSc in Cyber Security or Engineering

IEC 62443 training

ISO/IEC 27001/27005 training

Job description

FINRemote mogelijkZZP toegestaan# Risk Assessment AnalystVattenfall Kolding 12 maandenGepubliceerd 2 uur geleden · Opportunity ID: 1063147Tarief indicatie —Uren 40 u/wStart 15 Nov 2026Duur 12 maandenInteresse in deze opdracht?## De opdrachtNo target rate for this role; Submit your best rates\\*\\*Location is Kolding; Office precense is preferable - 2days per week. Remote workers is optional (travel for workshops ect. is expected)\\*\\*Contact at Magnit is Mattias DruggeVattenfall is looking for a Senior OT Risk Assessment Analyst. The assignment is; assessment of which operational risk and security risk they have. They have known risk in their risk register, but as an overall risk assessment has never been done before, the number of unknow risk are potentially high, and impact of those therefore unknown. Knowing what risks they have - means they can make informed decision and engineer fit for purpose security solutions. Important profile distinction: This is not primarily an IT/GRC risk role. The candidate must have sufficient OT and industrial understanding to determine how technical weaknesses, failures or compromises translate into operational and business risk.- Plan, structure and drive end-to-end OT cyber and operational risk identification and assessments across complex industrial environments, including identification of unknown or undocumented risks.- Apply IEC 62443, particularly IEC 62443-3-2, including risk assessment, zones and conduits, threat scenarios and Target Security Levels (SL-T), and translate identified risks into security requirements and treatments.- Assess asset/system criticality, threats, vulnerabilities, likelihood, operational consequences, inherent/residual risk and appropriate risk treatments.- Demonstrate strong OT/industrial domain knowledge, including SCADA, PLCs, HMIs, engineering workstations, OT networks, remote/vendor connectivity and legacy/EOL technology.- Analyse OT architectures and dependencies, including zones, conduits, trust boundaries, critical data flows and dependencies on IT, vendors/OEMs, remote access and external services.- Lead structured risk-identification workshops with TA2/TA3, Engineering, Operations, Security and asset/system owners, using strong facilitation skills to uncover undocumented risks and challenge assumptions.- Assess risk in its operational and business context, considering availability, safety, production, environment, maintainability and regulatory/compliance impact, rather than technical severity alone.- Consolidate individual findings into a consistent portfolio-level OT risk picture, identifying systemic risks, asset-specific risks, dependencies, concentrations and recurring risk themes.- Mature OT risk registers and risk-management processes, including consistent risk statements, ratings, ownership, traceability, prioritisation and management-level reporting across organisational boundaries.- Translate prioritised risks into risk-treatment requirements and high-level solution scopes, enabling management, Technical Authorities and Engineering to make informed, risk-based decisions and progress subsequent engineering activities.Skills- Relevant technical/security education or equivalent senior professional experience.- Strong practical OT/ICS security and industrial risk-assessment experience.- Demonstrated practical knowledge of IEC 62443 and ISO/IEC 27001-family risk management, particularly IEC 62443-3-2 and ISO/IEC 27005.- Experience applying risk-management principles within industrial/OT environments, not solely traditional IT/GRC environments.- BSc/MSc in Cyber Security, Automation/Control Engineering, Electrical Engineering, Industrial Engineering, Risk Management or related discipline.- IEC 62443 training/certification.- ISO/IEC 27001 and/or ISO/IEC 27005 training, certification or recognised risk-management qualification.- Experience with ISO/IEC 27019 in the energy/utility sector. ISO describes ISO/IEC 27019:2024 specifically as information-security controls for the energy utility industry.- GICSP, CISSP, CISM, CRISC or comparable relevant professional certification.- Experience from energy, utilities, renewables or comparable critical infrastructure.- Fluent in EnglishEducation- Relevant technical/security education or equivalent senior professional experience.Languages- EnglishExperience level- expert- seniorTermsPayment - The payment term is 60 days. Magnit adds 7days of administration time on top of thatPer diem/Allowance - No per diem or allowance is offered for this clientTermination - The termination of consultants is set at a standard termination term of 7 daysExpenses - Mileage and expenses can be reported if included in the project