IT Risk and Control Specialist

Luxoft; Kraków; On-site; PLN 180,000 - 280,000; Full time

Job summary

Luxoft in Kraków is seeking an IT Risk and Controls Expert to strengthen our cybersecurity program by evaluating security controls, assessing IS risks, and guiding risk-based decisions.

You will lead security assessments, advise stakeholders, coordinate risk remediation, and manage third-party risk in a regulated financial services context.

Qualifications

• Demonstrable experience in Information Security (IS) or IT risk management.
• Experience in financial services or regulated environments.
• Familiarity with NIST CSF, ISO 27001, CIS Controls, or COBIT.
• Ability to communicate risk to both technical and non-technical stakeholders.

Responsibilities

• Identify, assess, and mitigate IS risks within the organization's cybersecurity program.
• Conduct security assessments of internal and third-party projects to evaluate controls.
• Provide security advisory guidance and risk-based recommendations to stakeholders.
• Coordinate security-related projects and drive remediation discussions with stakeholders.
• Manage third-party risk and communicate business impacts of identified risks.

Skills

Information Security

Cybersecurity

IT Risk Management

Stakeholder Communication

Risk Assessment

Regulated Environments

Cloud Security

Security Advisory

Third-Party Risk

Project Coordination

Tools

NIST CSF

ISO 27001

COBIT

CIS Controls

CCSP/CISSP

Job description

Join one of our leading investment banking clients as an IT Risk and Controls Expert. You will play a pivotal role in strengthening the organization's cybersecurity programme by evaluating security controls, identifying and assessing information security (IS) risks, and providing expert guidance to support risk-based decision-making and continuous improvement.

Responsibilities:

• Cybersecurity: Manage cybersecurity-related activities, including the identification, assessment, and mitigation of information security (IS) risks.
• Security Assessments: Conduct security assessments of internal projects and third-party service providers to evaluate control effectiveness and compliance with security requirements.
• Security Consulting: Provide security advisory services to stakeholders, offering guidance on security controls, risk treatment options, and policy requirements in business-friendly language.
• Project Management: Coordinate and manage security-related projects and initiatives, ensuring timely delivery and alignment with cybersecurity objectives.
• Third-Party Risk Management: Drive discussions regarding identified risks, communicate potential business impacts, and provide guidance on appropriate remediation actions.

Mandatory Skills Description:

• Demonstrable experience in Information Security (IS), Cybersecurity, IT Risk Management, or a related field.
• Experience operating within financial services, investment banking, or other regulated environments.
• Familiarity with industry frameworks and standards such as NIST CSF, ISO 27001, CIS Controls, or COBIT.
• Strong understanding of information security principles, risk management methodologies, and control frameworks.
• Experience providing security advisory and consulting services to technical and non-technical stakeholders.
• Ability to drive risk remediation discussions and influence stakeholders to achieve security objectives.
• Proven experience in cybersecurity risk management, security assessments, and control effectiveness reviews.
• Strong knowledge of cloud security concepts and cloud-related risk management practices.
• Experience assessing third-party service providers and managing associated security risks.
• Ability to provide clear, risk-based security advice and influence stakeholders at all organizational levels.
• Strong communication skills, with the ability to translate technical findings into actionable business recommendations.
• Excellent analytical and problem-solving capabilities, coupled with a practical approach to risk management.

Nice-to-Have Skills Description:

• Familiarity with ISO 27001, NIST CSF, CIS Controls, or similar security frameworks.
• Knowledge of AWS, Azure, or GCP security capabilities and cloud governance practices.
• Relevant certifications such as CISSP, CISM, CRISC, CCSK, or CCSP.