Risk Analyst

MPower Plus; Kraków; Vor Ort; PLN 160.000 - 230.000; Vollzeit

Zusammenfassung

MPower Plus in Kraków is seeking an experienced risk professional to join the CISO/OCRA team. You will assess third-party security risks, report to management, and ensure alignment with regulatory requirements.

You will analyze vendor controls, develop remediation plans, and communicate findings to senior stakeholders, including legal and compliance teams.

The role requires 5+ years in third-party risk or cybersecurity assessment; CISSP/CISM/CTPRP credentials are a plus.

Qualifikationen

• 5+ years of experience in third-party risk or cybersecurity assessment.
• Knowledge of regulatory guidelines such as FRBNY, FINMA, MAS, HKMA, DORA.
• Certifications such as CISSP, CISM, CISA, CRISC are advantageous.
• Strong written and verbal communication for senior partners and management.
• Familiarity with NIST Cybersecurity Framework and related standards.

Aufgaben

• Conduct risk assessments of third-party vendors to identify security threats and vulnerabilities.
• Report updates to management on third-party cybersecurity risk and compliance issues.
• Ensure risk assurance approaches align with policies and regulatory requirements.
• Analyze vendor security controls and compliance with industry best practices.
• Develop risk mitigation strategies to reduce exposure to cyber threats.
• Communicate findings to internal stakeholders including senior management and legal teams.
• Monitor vendor compliance through periodic assessments.

Kenntnisse

Vendor risk assessment

Cybersecurity assessment

Regulatory knowledge

NIST framework

Analytical skills

Jobbeschreibung

We are looking for candidates who have experience in the following areas:

• Conduct risk assessments of third-party vendors to identify potential security threats and vulnerabilities;
• Reporting regular updates to relevant committees and management teams on the status of 3rd party Cybersecurity risk and compliance issues based on internal/external & regulatory assessment results
• Ensure that 3rd party Cybersecurity risk assurance approach, plans and execution are aligned with standard operating policies and procedures, risk assurance standards and regulatory requirements
• Analyze and evaluate vendor security controls, policies, and procedures to ensure compliance with regulatory requirements and industry best practices;
• Develop and implement risk mitigation strategies to address identified vulnerabilities and reduce the organization's exposure to cyber threats;
• Communicate assessment findings and recommendations to internal stakeholders, including senior management, legal, and compliance teams;
• Monitor and track vendor compliance with security policies and procedures through cyclical/periodic assessment activities;

You’ll be working in the CISO/OCRA (Operational Consolidate Risk assessment) team in Poland. You'll take a part in supporting colleagues from different areas of the firm, including Risk Taxonomy Owners, Compliance & Operational Risk Controllers and Outsourcing & Supplier Management, in improving the overall risk assessment process and implementing the most effective remediation measures.

You have:

• Knowledge in regulatory guidelines and requirements: FRBNY, FINMA, MAS, HKMA, DORA etc.
• Knowledge and specialist in 3rd to Nth party security risk oversight and assessment
• Knowledge on internal / external and regulator engagements
• Cyber and Information security or data privacy related certifications (e.g. CISSP, CISM, CISA or CRISC) are an advantage.
• Ability to communicate both written and verbal for business key partners and management audience. Excellent negotiation, influencing and analytical skills are highly desired
• Knowledge in NIST Cybersecurity Framework and NIST 800 series documents and other such related frameworks: COBIT/ITIL/ISO
• Information Security audit or risk assessment experience in complex IT environments, including Cloud technologies would be beneficial.
• Proven ability to work both independently and as part of a team to deliver quality work in a fast-paced environment
• Flexibility and ability to think creatively and to identify new ways to approach old problems
• Phenomenal analytical, decision-making, and problem-solving skills
• Dedication to fostering an inclusive culture and value varied perspectives.
• 5+ years of experience in third-party risk assessment or cybersecurity assessment;
• Certifications such as Certified Third-Party Risk Professional (CTPRP) or Certified Information Systems Security Professional (CISSP) are a plus.