Security Assessor

emagine; Warszawa; Presencial; PLN 214.000 - 241.000; Jornada completa

Descripción de la vacante

emagine seeks an experienced TPRM Security Assessor in Poland (preferably Warsaw) to support third-party risk management through the end of 2026. You will conduct supplier security assessments, review documentation, and help address audit priorities.

You will engage with internal stakeholders and suppliers, communicate requirements, and contribute to continuous monitoring and remediation efforts. English proficiency is essential.

Formación

• 2+ years of experience in Third-Party Risk Management (TPRM) and information security.
• Experience performing vendor or supplier security assessments.
• Familiarity with industry-standard assurance reports (SOC 2, ISO 27001, CAIQ, SIG).

Responsabilidades

• Conduct information security assessments of new and existing suppliers.
• Review supplier responses, security documentation, certifications, audit reports, and evidence.
• Evaluate supplier security posture and identify risks and control gaps.
• Provide risk-based recommendations to stakeholders and project teams.
• Execute periodic reassessments and support ongoing monitoring.

Conocimientos

TPRM

Information Security

Cybersecurity Risk Management

IT Audit or GRC

Herramientas

SOC 2

ISO 27001

CAIQ

SIG

Descripción del empleo

TPRM Security Assessor

Location: Poland (preferably Warsaw)

Start: ASAP

Remuneration: 155- 175 PLN/h

Contract Duration: Until 31 December 2026

Department: Global Security - Information Security Governance / Third-Party Risk Management (TPRM)

Reporting to: Manager, Information Security Governance

About The Role

We are seeking an experienced Security Assessor to support Third-Party Risk Management (TPRM) operations through the end of 2026. The consultant will play a key role in executing supplier security assessments, supporting reassessment activities, engaging with internal stakeholders and suppliers, and helping the team address ongoing operational and audit-related priorities.

This role is ideal for a cybersecurity or risk management professional who enjoys working in a fast-paced environment and has experience evaluating third-party security controls and managing supplier risk.

Key Responsibilities

Supplier Security Assessments

• Conduct information security assessments of new and existing suppliers.
• Review supplier responses, security documentation, certifications, audit reports, and evidence.
• Evaluate supplier security posture and identify potential risks and control gaps.
• Provide risk-based recommendations to business stakeholders and project teams.
• Support assessment prioritization based on supplier criticality and risk exposure.

Reassessments and Ongoing Monitoring

• Execute periodic reassessments of suppliers according to established risk-based cycles.
• Follow up with suppliers regarding overdue assessments and remediation activities.
• Support tracking of reassessment deadlines and escalation processes.
• Contribute to continuous monitoring activities and review of security posture changes.

Stakeholder and Supplier Engagement

• Serve as a security point of contact for internal business stakeholders and suppliers.
• Clearly communicate security requirements and assessment outcomes.
• Facilitate meetings and discussions related to supplier security concerns.
• Support resolution of assessment findings and clarification requests.

Process and Documentation Support

• Maintain accurate records of assessments, findings, and decisions within TPRM tools.
• Support the quality and consistency of assessment documentation.
• Identify opportunities to improve assessment processes, templates, and workflows.
• Assist with audit evidence collection and reporting activities when required.

Requirements

• 2+ years of experience in:
  • Third-Party Risk Management (TPRM)
  • Information Security
  • Cybersecurity Risk Management
  • IT Audit or Governance, Risk, and Compliance (GRC)
• Experience performing vendor or supplier security assessments.
• Strong understanding of information security principles and common control domains, including:
  • Access Management
  • Vulnerability Management
  • Incident Response
  • Business Continuity
  • Security Monitoring
  • Data Protection
• Experience reviewing security questionnaires and industry-standard assurance reports (e.g., SOC 2, ISO 27001, CAIQ, SIG).
• Excellent written and verbal communication skills in English.

Nice to have

• Relevant certifications such as:
  • CRISC
  • CISA
  • CISSP
  • ISO 27001 Lead Auditor
  • CTPRP
• Experience with security governance, supplier risk management, or GRC platforms.
• Experience working in an international and cross-functional environment.
• Knowledge of privacy and data protection requirements related to third-party services.

Personal Competencies

• Strong analytical and risk-based decision-making skills.
• Attention to detail and ability to manage multiple assessments simultaneously.
• Ability to work independently with minimal supervision.
• Strong stakeholder management and collaboration skills.
• Continuous improvement mindset and focus on operational excellence.

What Success Looks Like

By the end of the engagement, the consultant will have:

• Supported delivery of supplier security assessments and reassessments in line with agreed priorities.
• Helped reduce assessment backlogs and improve reassessment governance.
• Contributed to audit readiness and evidence collection activities.
• Ensured high-quality, risk-based assessment outcomes and stakeholder support.