Senior Third Party Cyber and Information Security Analyst

INFOPLUS TECHNOLOGIES; Kraków; Hybrid; PLN 180,000 - 260,000; Full time

Benefits offered by this job

Hybrid work model

Job summary

INFOPLUS TECHNOLOGIES is seeking a seasoned professional for Third Party Cyber and Information Security - Remediation. You will evaluate remediation of cyber control gaps identified in CIS risk assessments for vendors with access to client data and systems.

You will review evidence from Risk Treatment Plan closures, assess regulatory and industry-standard compliance, and help design and implement effective remediation strategies. Strong communication with stakeholders is essential.

Qualifications

• Bachelor's degree with cybersecurity or audit certification.
• 5+ years in third-party risk or cybersecurity assessment.
• Audit mindset and experience closing regulatory issues.
• Ability to communicate with technical and non-technical stakeholders.
• Fluent English; strong analytical and risk mitigation skills.

Responsibilities

• Evaluate remediation of cyber control gaps from CIS risk assessments.
• Review evidence from Risk Treatment Plan closures.
• Assess vendor security controls for regulatory compliance.
• Develop and implement risk mitigation strategies.
• Communicate findings to senior management, legal, and compliance teams.
• Monitor vendor compliance through ongoing assessments.

Skills

Strong communicator

Analytical thinking

Problem solving

Team player

Project leadership

Education

Bachelor's degree with cybersecurity or audit certification

Job description

Job Description:

Third Party Cyber and Information Security - Remediation

Your role:

You will be responsible for evaluating the remediation of Cyber Security control gaps relating to deficiencies identified as part of a CIS risk assessment where third-party vendors that have access to sensitive information or systems of client. You will conduct reviews of evidence shared as part of Risk Treatment Plan closure to identify and evaluate if potential security threats posed by third-party vendors are appropriately remediated in line with client’s cybersecurity policies and procedures.

We are looking for candidates who have experience in the following areas:

• business risk management, or regulatory and audit issue experience in NFRI/operational risk issues closure, in line with standard procedures.
• exposure to cyber tech risk assessments of third-party vendors to identify potential security threats and vulnerabilities outcome.
• analyze and evaluate vendor security controls, policies, and procedures to ensure compliance with regulatory requirements and industry best practices.
• develop and implement risk mitigation strategies to address identified vulnerabilities and reduce the organization's exposure to cyber threats.
• communicate assessment findings and recommendations (including control requirements) to internal stakeholders, including senior management, legal, and compliance teams.
• monitor and track vendor compliance with security policies and procedures through ongoing assessment activities.

You’ll be working in the CISO/ TP CIS Oversight Remediation Team. You'll take a part in supporting colleagues from different areas of the firm, including Risk Taxonomy Owners, Compliance & Operational Risk Controllers and Outsourcing & Supplier Management, in improving the overall risk assessment process and implementing the most effective remediation measures.

You have:

• Bachelor's degree with professional certification in Cybersecurity or Audit, Cloud Security or a related field of study;
• audit experience/mindset;
• 5+ years of experience in third-party risk assessment or cybersecurity assessment and regulatory and audit issue closure
• Closely monitor and suggest the remediation requirements to third parties & business stakeholders
• ability to communicate effectively with both technical and non-technical stakeholders;
• strong analytical and problem-solving skills;
• certifications such as Certified Third-Party Risk Professional (CTPRP) or Certified Information Systems Security Professional (CISSP) or CISA (Certified Information Security Auditor) are a plus.

Additional assets:

• experience with industry recognized standards for IT security controls and best practices like NIST, ISO27001, PCI DSS, COBIT, SOC 2 etc.;
• one of the following professional qualifications obtained: CEH, CISSP, CISA, CISM, CRISC or ITIL.

Your expertise:

• a strong communicator, with good spoken and written English;
• good team player with analytical ability to provide practical solutions for minimizing risk;
• well organized, detail oriented, with the ability to collect data, coordinate tasks and lead projects;
• comfortable taking the lead, but not hesitant to bring in the expertise of colleagues to help the team;
• having risk identification and risk articulation skills;
• able to build and maintain strong relations with stakeholders;
• able to show initiative, make logical decisions and stay goal oriented at unclear times;
• available to work in hybrid model at least 3 days from the office.