Cyber Security Governance and Risk Analyst

Cpl Group; Dublin; On-site; EUR 70,000 - 110,000; Full time

Job summary

Public Service Organisation in Ireland seeks a Cyber Security & Risk Analyst to lead governance, risk management, and incident response for a 12-month contract with potential renewal.

You will maintain cyber policies, manage risk registers, coordinate audits, support supplier security, and report to executives. Strong knowledge of NIS2, ISO 27001 and NIST CSF is required; professional certifications are desirable.

Qualifications

• Minimum 5 years' experience in information security or IT risk.
• Experience in regulated healthcare or public sector environments.
• Knowledge of cyber risk management, control assessments and governance reporting.
• Experience developing and monitoring cyber policies and procedures.
• Experience preparing cyber security reports for senior governance forums.

Responsibilities

• Coordinate cyber governance activities and prepare briefing packs for EMT, Board and governance forums.
• Maintain cyber risk registers with owners, ratings and milestones; reflect risks in corporate risk where appropriate.
• Support incident response planning, tabletop exercises and post-incident improvements.
• Assist security operations: vulnerability management, logging, monitoring and baseline development.
• Coordinate supplier security assessments, onboarding and contract reviews.
• Support internal and external audits, evidence gathering and management responses.
• Track cyber training completion and promote a security-aware culture.
• Prepare clear reports for CIO, EMT, CEO and Board-wide governance bodies.

Skills

Cyber security governance

Risk management

Incident response

Stakeholder management

Governance reporting

Policy development

Regulatory compliance

Project coordination

Communication

Education

CISSP

CISM

CRISC

CISA

Job description

We're partnering with an integral public service organisation that supports Ireland's healthcare industry and millions of patients across the country.

They're looking for a Cyber Security & Risk Analyst to join them on a 12 month contract, with the possibility of renewal.

The Role

Cyber Security Governance

• Coordinate cyber governance activities across the organisation.
• Support compliance and resilience activities relating to NIS2, CyFun, and other relevant cyber security requirements.
• Prepare cyber governance reports, briefing papers, meeting packs and action trackers for relevant governance groups, including EMT, ARC, Board, programme boards, working groups and IT governance forums.
• Manage cyber and information security policies, standards, procedures, SOPs, guidance documents and supporting templates, including coordinating review and periodic refresh.
• Support rollout and implementation of cyber policies and SOPs across IT and relevant business areas
• Maintain oversight of the cyber remediation plan, including actions, owners, milestones, dependencies, risks, issues, status and evidence of completion.

Cyber Risk Management

• Coordinate the upkeep of the cyber risk register, ensuring risks have clear owners, ratings, treatment plans, target dates and status.
• Work with the Risk and Resilience function to ensure cyber risks are reflected in the corporate risk register where appropriate.
• Maintain cyber KPIs, KRIs and management dashboards covering risk exposure, remediation, training, vulnerabilities, incidents, supplier assurance and control maturity.

Incident Response

• Maintain the Major incident response plan and supporting playbooks, escalation paths and contact lists.
• Coordinate cyber incident readiness activities, including tabletop exercises, lessons learned reviews and follow-up action tracking.
• Support incident response planning, evidence gathering, communications, reporting, escalation and post-incident improvement activities.

Security Operations

• Support improvement activities relating to vulnerability management, patch management, secure configuration, logging, monitoring, endpoint protection, malware controls, network security, remote access and identity controls.
• Support development of secure baselines for business-critical systems and track exceptions or overdue remediation items.

Third-Party and Supplier Security Management

• Support cyber security input into supplier onboarding, procurement, contract reviews and supplier assurance activities.
• Coordinate cyber risk assessments for suppliers and third-party service providers.
• Track supplier-related cyber risks, remediation actions, assurance evidence and contractual obligations.
• Support external assurance activities relating to supplier security controls and operational resilience.

Audit and Compliance Support

• Support internal and external audit activities relating to information security, cyber security, resilience and compliance.
• Coordinate evidence gathering, management responses, action tracking and closure evidence for cyber audit findings.
• Monitor cyber security regulatory developments and assess their relevance to the organisation.

Cyber Awareness

• Track completion of cyber training and report on awareness programme performance.
• Promote a strong cyber security culture across the organisation by making cyber responsibilities clear and practical.
• Support targeted cyber training for incident response teams, system owners, IT teams, project teams and business stakeholders.

Stakeholder Management, Communication and Reporting

• Act as a key point of coordination for cyber security matters across the organisation.
• Prepare clear and concise reports for CIO, EMT, CEO, Board, ARC, programme boards, working groups, NCSC engagements, internal audit and other governance forums as required.

Experience and Qualifications

• Minimum 5 years' experience in information security, cyber security, IT risk, security operations, IT governance, audit, compliance or a related IT discipline.
• Demonstrable experience managing or coordinating information security activities in a regulated, healthcare, public sector, critical service or operationally sensitive environment.
• Strong knowledge of cyber risk management, control assessments, remediation tracking and governance reporting.
• Experience developing, reviewing, implementing and monitoring cyber security policies, standards, SOPs and procedures.
• Experience preparing cyber security reports for senior management, executive committees, audit/risk committees or Board-level governance forums.
• Practical understanding of NIS2, CyFun, ISO 27001, NIST Cybersecurity Framework.
• Experience coordinating cyber incident response planning, incident exercises, tabletop exercises and post-incident improvement actions.
• Experience supporting internal or external audits, evidence gathering, action tracking and management responses.
• Experience working with third-party technology providers, managed service providers, cyber advisory partners or security vendors.
• Excellent stakeholder management, communication, documentation, meeting facilitation and project coordination skills.
• Ability to work independently, manage multiple priorities, follow up actions to closure and escal…

Desirable skills

• Strong technical understanding across IT infrastructure, networks, identity and access management, endpoint security, cloud/SaaS, logging, monitoring, backup, disaster recovery and vulnerability management.

Relevant professional certification such as CISSP, CISM, CRISC, CISA.