Operational Risk assessment Analyst

MPower Plus; Województwo małopolskie; On-site; PLN 180,000 - 260,000; Full time

Job summary

MPower Plus is seeking an experienced cybersecurity professional to assess the security posture of third-party vendors and identify threats. You will develop mitigation strategies and work with internal stakeholders to ensure compliance with cybersecurity policies and regulatory requirements.

The role requires 5+ years in third-party risk or cybersecurity assessment, with certifications such as CISSP/CISM/CISA; CTPRP is a plus.

Qualifications

• Experience conducting risk assessments of third-party vendors.
• Ability to report updates to committees and management on 3rd party risk.
• Knowledge of regulatory requirements (DORA, NIST, COBIT/ITIL/ISO).
• Experience auditing vendor security controls and compliance.

Responsibilities

• Conduct risk assessments of third-party vendors to identify threats and vulnerabilities.
• Report status of third-party cybersecurity risk and compliance to management.
• Ensure 3rd party risk activities align with policies, standards and regulatory requirements.
• Analyze vendor security controls and policies for compliance with standards.
• Develop and implement risk mitigation plans to reduce exposure.
• Communicate findings to senior management, legal and compliance teams.
• Monitor vendor compliance through periodic assessments.

Skills

Risk assessment

Regulatory knowledge

Stakeholder communication

Analytical thinking

Problem solving

Independent work

Team collaboration

Vendor management

Education

CISSP/CISM/CISA/CRISC certifications

CTPRP certification (advantage)

Job description

You will be responsible for evaluating the security posture of third-party vendors that have access to sensitive information or systems of. You will conduct risk assessments to identify and evaluate potential security threats posed by third-party vendors and recommend risk mitigation strategies to minimize the organization's exposure to cyber threats. You will also work closely with internal stakeholders to ensure that third-party vendors comply with our cybersecurity policies and procedures.

We are looking for candidates who have experience in the following areas:

• Conduct risk assessments of third-party vendors to identify potential security threats and vulnerabilities
• Reporting regular updates to relevant committees and management teams on the status of 3rd party Cybersecurity risk and compliance issues based on internal/external & regulatory assessment results
• Ensure that 3rd party Cybersecurity risk assurance approach, plans and execution are aligned with standard operating policies and procedures, risk assurance standards and regulatory requirements
• Analyze and evaluate vendor security controls, policies, and procedures to ensure compliance with regulatory requirements and industry best practices
• Develop and implement risk mitigation strategies to address identified vulnerabilities and reduce the organization's exposure to cyber threats
• Communicate assessment findings and recommendations to internal stakeholders, including senior management, legal, and compliance teams
• Monitor and track vendor compliance with security policies and procedures through cyclical/periodic assessment activities

You’ll be working in the CISO/OCRA (Operational Consolidate Risk assessment) team in Poland. You'll take a part in supporting colleagues from different areas of the firm, including Risk Taxonomy Owners, Compliance & Operational Risk Controllers and Outsourcing & Supplier Management, in improving the overall risk assessment process and implementing the most effective remediation measures.

You have:

• Knowledge in regulatory guidelines and requirements: FRBNY, FINMA, MAS, HKMA, DORA etc.
• Knowledge and specialist in 3rd to Nth party security risk oversight and assessment
• Knowledge on internal / external and regulator engagements
• Cyber and Information security or data privacy related certifications (e.g. CISSP, CISM, CISA or CRISC) are an advantage.
• Ability to communicate both written and verbal for business key partners and management audience. Excellent negotiation, influencing and analytical skills are highly desired
• Knowledge in NIST Cybersecurity Framework and NIST 800 series documents and other such related frameworks: COBIT/ITIL/ISO
• Information Security audit or risk assessment experience in complex IT environments, including Cloud technologies would be beneficial.
• Proven ability to work both independently and as part of a team to deliver quality work in a fast-paced environment
• Flexibility and ability to think creatively and to identify new ways to approach old problems
• Phenomenal analytical, decision-making, and problem-solving skills
• Dedication to fostering an inclusive culture and value varied perspectives.
• 5+ years of experience in third-party risk assessment or cybersecurity assessment;
• Certifications such as Certified Third-Party Risk Professional (CTPRP) or Certified Information Systems Security Professional (CISSP) are a plus.