Cyber Risk & GRC Analyst

NewCold; Breda; Presencial; EUR 70.000 - 110.000; Jornada completa

Descripción de la vacante

NewCold's cyber risk function is scaling fast. This hands-on role focuses on triaging intake, maintaining the risk register day-to-day, chasing evidence, and turning raw risk data into actionable reports for leadership.

You will own risk articulation, scoring, and due diligence for suppliers, handling high-volume triage under time pressure, and collaborating with engineers, procurement, IT, and business leaders across regions to drive timely risk closure.

Formación

• 3-5 years in cyber security risk management, IT risk, or GRC in regulated/complex environments.
• Hands-on risk register ownership: articulation, scoring, treatment tracking, executive-ready reporting.
• Supplier/third-party risk assessment: due diligence, evidence review, posture evaluation, volume.
• High-volume triage: prioritise intake queue by risk and business impact without slips.
• Experience mapping controls to risk outcomes using ISO/IEC 27001/27002, NIST CSF or CIS Controls.

Responsabilidades

• Triaging intake and maintaining the risk register day-to-day.
• Running supplier/third-party risk assessments and due diligence at volume.
• Turning raw risk data into executive-ready reports for leadership.
• Collaborating with engineers, procurement, IT and business stakeholders across regions to ensure items close out.

Conocimientos

Cyber security risk management

Risk articulation & reporting

Third-party risk assessment

High-volume triage

Frameworks knowledge (ISO 27001/NIST/C

Stakeholder communication

Educación

CRISC certification

Herramientas

Archer

ServiceNow GRC

Jira

Monday.com

Descripción del empleo

NewCold's cyber risk function is scaling fast: risk assessments, supplier due diligence, and (ISO 27001 and NIS2-driven governance work have grown to a volume that needs a dedicated person to provide the right level of focus.

This role exists to keep that pipeline moving: triaging intake, running the risk register day-to-day, chasing evidence collection, and turning raw risk data into reporting that leadership can act on. It's a hands-on, high-throughput role rather than a strategic or policy-setting one.

We're looking for someone who's actually run a risk register under time pressure, not just someone who can talk fluently about frameworks.

Must-have experience:

• 3-5 years in cyber security risk management, IT risk, or GRC, in a regulated or complex enterprise environment.
• Hands-on risk register ownership: risk articulation, scoring, treatment tracking, and producing executive-ready reporting.
• Supplier/third-party risk assessment execution: questionnaire-based due diligence, evidence review, and posture evaluation, done independently and at volume.
• High-volume triage: proven ability to prioritize a busy intake queue based on risk and business impact, without things slipping.
• Working knowledge and experience with frameworks such as: ISO/IEC 27001/27002, NIST CSF, or CIS Controls with the ability to map control evidence to risk outcomes.
• Communication & cross-cultural stakeholder skills: strong written and verbal communication skills, with the ability to adapt tone and approach across internal and external stakeholders, from technical engineers to senior business leaders to third-party suppliers.
• Comfortable operating across cultures and communication styles given NewCold's multinational footprint, and able to build trust and drive follow-through with stakeholders from different regional and organisational backgrounds.
• Stakeholder follow-through: comfortable chasing technical teams, procurement, IT, and business stakeholders repeatedly until items close out.

Preferred / nice-to-have:

• Exposure to supplier tiering, criticality assessment, or ongoing supplier monitoring models.
• Familiarity with OT/industrial risk concepts (e.g. IEC 62443, Purdue model) would be a plus given NewCold's OT environment.
• Certified in Risk and Information Systems Control (CRISC).
• Experience with GRC or workflow tooling (e.g. Archer, ServiceNow GRC, Jira, Monday.com or equivalent).
• Prior experience operating across multiple regions/time zones.
• Understanding of risk governance concepts: risk appetite, residual risk, risk acceptance, escalation paths.

How success looks like in the first 6 months:

• Risk register is current, accurately scored, and reporting cadence is reliable without prompting.
• Supplier risk assessment backlog is under control, with clear tiering and a repeatable evidence-review process.
• Stakeholders across regions know who to go to and trust the follow-up will happen.