Security Risk Manager

Ework Group; Wrocław; Hybrid; PLN 240,000 - 360,000; Full time

Job summary

Ework Group in Poland seeks a Senior IT Security & Risk Officer (Third-Party Risk Management) in Wrocław with hybrid work arrangement (2 days in office). The role focuses on assessing external suppliers and services, guiding onboarding, and strengthening the TPRM framework to align with security standards.

The candidate will review vendor documentation, perform risk assessments, and collaborate with procurement, legal and cybersecurity teams to enforce security controls and governance.

Qualifications

• Experience in cybersecurity, information security, IT risk management or related fields.
• Minimum 3 years performing third-party security assessments or supplier risk reviews.
• Ability to translate technical findings into actionable risk decisions.
• Experience in large enterprises with governance processes and multiple stakeholders.
• Proven ability to work with external suppliers and manage risk discussions.
• Familiarity with ISO 27001, NIST CSF, SOC 2, NIS2, DORA, CIS Controls and AI governance.
• Excellent written and verbal English communications.

Responsibilities

• Assess security posture of external suppliers, products and services (SaaS, COTS, cloud, hardware, OT).
• Review supplier responses, documentation and security reports to evaluate risk posture.
• Provide risk-based recommendations and remediate non-compliance points.
• Engage with suppliers and internal stakeholders on security and risk matters.
• Lead onboarding and lifecycle management for third-party risk.
• Collaborate with procurement, legal, compliance and cybersecurity teams to enforce security requirements.
• Identify gaps in the TPRM process and drive improvements.
• Monitor threats, regulatory changes and industry best practices.

Skills

Cybersecurity

IT risk management

Third-party risk management

Stakeholder collaboration

English communication

Job description

For our Client from automotive industry, we are looking for a Senior IT Security & Risk Officer (Third-Party Risk Management) - Wrocław - hybrid work mode (2 days at the office)

Job Description:

You will assess the security posture of external suppliers, products and services, act as a trusted advisor on third-party cybersecurity risks throughout supplier onboarding and lifecycle management, and help develop the Third-Party Risk Management (TPRM) process.

The role covers a broad range of technologies, including SaaS solutions, COTS applications, cloud services, hardware and OT-related solutions, and involves working with international suppliers.

Responsibilities:

• Perform security risk assessments of third-party suppliers, products and services (SaaS, COTS, cloud, hardware, OT-related solutions).
• Review supplier responses, technical documentation, security reports and supporting evidence to evaluate security posture and identify potential risks.
• Analyze identified risks, address points of non-compliance and provide clear, risk-based recommendations.
• Engage directly with suppliers and internal stakeholders to clarify security, compliance and risk-related matters.
• Act as a trusted advisor on third-party cybersecurity risks during supplier onboarding and throughout the supplier lifecycle.
• Collaborate with procurement, legal, compliance, business and cybersecurity teams to ensure security requirements are properly addressed, and align assessments with internal security standards, policies and corporate requirements.
• Drive continuous improvement of the TPRM process, methodologies and assessment practices: identify process gaps and inefficiencies, then propose and implement corrective actions.
• Monitor emerging threats, regulatory requirements and industry best practices to keep the assessment framework effective and up to date.

Requirements:

• Minimum 5 years of professional experience in cybersecurity, information security, IT risk management or related areas.
• Minimum 3 years of hands-on experience performing third-party security assessments, supplier security reviews, technology risk assessments or similar activities.
• Demonstrated experience analyzing technical and security documentation and translating findings into actionable risk decisions.
• Experience in large enterprise environments with multiple stakeholders and governance processes.
• Experience collaborating with external suppliers and managing security-related discussions and follow-up activities.
• Strong understanding of cybersecurity principles and risk management practices.
• Practical knowledge of TPRM, supply chain security and vendor risk assessment methodologies.
• Experience assessing security controls against recognized frameworks and standards: ISO 27001, NIST Cybersecurity Framework, SOC 2, NIS2, DORA, CIS Controls.
• Understanding of AI governance, AI-related risks and regulatory requirements such as the EU AI Act.
• Experience working with internal corporate security policies, standards and compliance requirements.
• Excellent written and verbal communication skills in English.

Way of Working:

• Strong analytical, problem-solving and critical-thinking skills.
• Comfortable acting as a trusted advisor and navigating complex enterprise environments with many stakeholders.
• Ability to work with international suppliers and communicate clearly in English, both in writing and verbally.

Nice to Have:

• CISSP, SSCP, CISM, CRISC or equivalent cybersecurity certification.
• ISO 27001 Lead Auditor, Lead Implementer or similar audit/compliance certification.
• Experience contributing to the design, implementation or improvement of security governance and risk management processes.