Third Party Risk Management Analyst

ALOIS Solutions; Województwo małopolskie; Vor Ort; PLN 180.000 - 280.000; Vollzeit

Zusammenfassung

ALOIS Solutions is seeking an experienced Cybersecurity Risk Assessor to evaluate third-party vendors and their security postures. You will perform risk assessments, identify threats, and propose mitigation strategies, while ensuring compliance with policies, standards, and regulatory requirements.

You will work within the CISO/OCRA team in Poland, coordinating with Risk Taxonomy Owners, Compliance, and Outsourcing/Supplier Management to improve the risk assessment process and remediation

Qualifikationen

• Knowledge of regulatory guidelines and requirements (e.g., FRBNY, FINMA, MAS, HKMA, DORA)
• Experience in 3rd to Nth party security risk oversight and assessment
• Ability to engage with internal/external regulators and stakeholders
• Information security or data privacy certifications are advantageous
• Strong communication, negotiation and analytical skills desired
• Familiarity with NIST, COBIT, ITIL, ISO frameworks
• Experience with IT security controls in complex environments including cloud

Aufgaben

• Conduct risk assessments of third-party vendors to identify threats and vulnerabilities
• Report updates to committees and management on 3rd party risk and compliance
• Ensure risk assurance approaches align with policies, standards and regulatory requirements
• Analyze vendor security controls and compliance with regulatory standards
• Develop and implement risk mitigation strategies to reduce exposure
• Communicate findings and recommendations to senior management and legal/compliance
• Monitor vendor compliance through periodic assessment activities
• Collaborate with cross-functional teams in Poland within the CISO/OCRA team

Kenntnisse

3rd party risk oversight

Regulatory frameworks

NIST CSF / ISO27001 knowledge

Communication with executives

Risk assessment methodologies

Analytical decision making

Ausbildung

Bachelor's in IT / CS / related

Cybersecurity certifications (CISSP/CISM/CISA/CRISC)

Tools

NIST CSF

ISO27001

PCI DSS

Jobbeschreibung

You will be responsible for evaluating the security posture of third-party vendors that have access to sensitive information or systems of. You will conduct risk assessments to identify and evaluate potential security threats posed by third-party vendors and recommend risk mitigation strategies to minimize the organization's exposure to cyber threats. You will also work closely with internal stakeholders to ensure that third-party vendors comply with our cybersecurity policies and procedures.

We are looking for candidates who have experience in the following areas:

• Conduct risk assessments of third-party vendors to identify potential security threats and vulnerabilities;
• Reporting regular updates to relevant committees and management teams on the status of 3rd party Cybersecurity risk and compliance issues based on internal/external & regulatory assessment results
• Ensure that 3rd party Cybersecurity risk assurance approach, plans and execution are aligned with standard operating policies and procedures, risk assurance standards and regulatory requirements
• Analyze and evaluate vendor security controls, policies, and procedures to ensure compliance with regulatory requirements and industry best practices;
• Develop and implement risk mitigation strategies to address identified vulnerabilities and reduce the organization's exposure to cyber threats;
• Communicate assessment findings and recommendations to internal stakeholders, including senior management, legal, and compliance teams;
• Monitor and track vendor compliance with security policies and procedures through cyclical/periodic assessment activities;
• You’ll be working in the CISO/OCRA (Operational Consolidate Risk assessment) team in Poland. You'll take a part in supporting colleagues from different areas of the firm, including Risk Taxonomy Owners, Compliance & Operational Risk Controllers and Outsourcing & Supplier Management, in improving the overall risk assessment process and implementing the most effective remediation measures.

You have:

• Knowledge in regulatory guidelines and requirements: FRBNY, FINMA, MAS, HKMA, DORA etc.
• Knowledge and specialist in 3rd to Nth party security risk oversight and assessment
• Knowledge on internal / external and regulator engagements
• Cyber and Information security or data privacy related certifications (e.g. CISSP, CISM, CISA or CRISC) are an advantage.
• Ability to communicate both written and verbal for business key partners and management audience. Excellent negotiation, influencing and analytical skills are highly desired
• Knowledge in NIST Cybersecurity Framework and NIST 800 series documents and other such related frameworks: COBIT/ITIL/ISO
• Information Security audit or risk assessment experience in complex IT environments, including Cloud technologies would be beneficial.
• Proven ability to work both independently and as part of a team to deliver quality work in a fast-paced environment
• Flexibility and ability to think creatively and to identify new ways to approach old problems
• Phenomenal analytical, decision-making, and problem-solving skills
• Dedication to fostering an inclusive culture and value varied perspectives.
• 5+ years of experience in third-party risk assessment or cybersecurity assessment;
• Certifications such as Certified Third-Party Risk Professional (CTPRP) or Certified Information Systems Security Professional (CISSP) are a plus.

Your team :

Additional assets: experience with industry recognized standards for IT security controls and best practices like NIST, ISO27001, PCI DSS, COBIT, SOC 2 etc.; one of the following professional qualifications obtained: CEH, CISSP, CISA, CISM, CRISC or ITIL.

• A strong communicator, with good spoken and written English;
• Good team player with analytical ability to provide practical solutions for minimizing risk;
• Well organized, detail oriented, with the ability to collect data, coordinate tasks and lead projects;
• Having risk identification and risk articulation skills;
• Able to build and maintain strong relations with stakeholders;
• Able to show initiative, make logical decisions and stay goal oriented at unclear times