Strategic Supplier Cyber Risk Assessor

Engenious; Kraków; Hybrid; PLN 193,000 - 248,000; Full time

Benefits offered by this job

Private Medical Care – INTER Polska

Co-funded Multisport Card

Training and certification subsidies

Job summary

Engenious is seeking a Supplier Cyber Assessor to support Third-Party Cyber Risk Management. You will assess and manage cybersecurity risks across the supplier lifecycle, working with internal teams and suppliers to define remediation actions and monitor closure.

The role requires a solid understanding of cybersecurity frameworks, supplier risk, and regulatory requirements, including NIS2 and CRA, with opportunities to improve risk processes and tooling.

Qualifications

• 2–3 years in cybersecurity or third‑party risk management.
• Solid understanding of ISO 27001/27002/27005.
• Knowledge of the NIST CSF and/or NIST 800-53.
• Familiarity with NIS2 requirements and CRA implications.
• Experience with security questionnaires or supplier risk management.

Responsibilities

• Conduct and validate inherent risk assessments with stakeholders.
• Perform cyber risk assessments for suppliers and identify gaps.
• Assess supplier controls against cybersecurity and contractual requirements.
• Ensure alignment with CSS and relevant standards and regulations.
• Document and track remediation plans with timelines.
• Record and escalate supplier non‑compliance when needed.
• Collaborate with Sourcing, Legal, IT Security and Business teams.

Skills

Cyber risk assessment

GRC knowledge

Regulatory understanding

Stakeholder communication

Education

Bachelor's or Master's in IT/Cybersecurity

Tools

OneTrust

ServiceNow

BitSight

Job description

Engenious is seeking a Supplier Cyber Assessor to support Third-Party Cyber Risk Management. You will assess and manage cybersecurity risks across the supplier lifecycle, working with internal teams and suppliers to define remediation actions and monitor closure.

The role requires a solid understanding of cybersecurity frameworks, supplier risk, and regulatory requirements, including NIS2 and CRA, with opportunities to improve risk processes and tooling.