Senior Third-Party Cyber Risk Analyst

MPower Plus; Kraków; On-site; PLN 160,000 - 230,000; Full time

Job summary

MPower Plus in Kraków is seeking an experienced risk professional to join the CISO/OCRA team. You will assess third-party security risks, report to management, and ensure alignment with regulatory requirements.

You will analyze vendor controls, develop remediation plans, and communicate findings to senior stakeholders, including legal and compliance teams.

The role requires 5+ years in third-party risk or cybersecurity assessment; CISSP/CISM/CTPRP credentials are a plus.

Qualifications

• 5+ years of experience in third-party risk or cybersecurity assessment.
• Knowledge of regulatory guidelines such as FRBNY, FINMA, MAS, HKMA, DORA.
• Certifications such as CISSP, CISM, CISA, CRISC are advantageous.
• Strong written and verbal communication for senior partners and management.
• Familiarity with NIST Cybersecurity Framework and related standards.

Responsibilities

• Conduct risk assessments of third-party vendors to identify security threats and vulnerabilities.
• Report updates to management on third-party cybersecurity risk and compliance issues.
• Ensure risk assurance approaches align with policies and regulatory requirements.
• Analyze vendor security controls and compliance with industry best practices.
• Develop risk mitigation strategies to reduce exposure to cyber threats.
• Communicate findings to internal stakeholders including senior management and legal teams.
• Monitor vendor compliance through periodic assessments.

Skills

Vendor risk assessment

Cybersecurity assessment

Regulatory knowledge

NIST framework

Analytical skills

Job description

MPower Plus in Kraków is seeking an experienced risk professional to join the CISO/OCRA team. You will assess third-party security risks, report to management, and ensure alignment with regulatory requirements.

You will analyze vendor controls, develop remediation plans, and communicate findings to senior stakeholders, including legal and compliance teams.

The role requires 5+ years in third-party risk or cybersecurity assessment; CISSP/CISM/CTPRP credentials are a plus.