Third Party Security Risk Manager (m/f/d)

JT International S.A.; Poland; On-site; PLN 224,803 - 299,737; Full time

Job summary

JT International S.A. is seeking a Third Party Security Risk Manager responsible for managing the Third-Party Security Risk Management program. The role involves ensuring vendors meet JTI's cybersecurity, compliance, and risk management requirements.

This position requires strong analytical skills, excellent communication abilities, and a bachelor's degree in a related field. Candidates should have over 5 years of experience in cybersecurity or risk management, along with relevant professional certifications.

Qualifications

• 5+ years experience in cybersecurity, risk management or related fields.
• Strong understanding of NIST, ISO 27001, and GDPR.
• Experience supporting cloud security assessments.

Responsibilities

• Conduct cybersecurity risk assessments for third-party vendors.
• Ensure third-party compliance with applicable frameworks and policies.
• Document identified security risks and control deficiencies.

Skills

Fluent English written and spoken

Strong analytical skills

Risk assessment skills

Excellent written and verbal communication

Organizational skills

Stakeholder management skills

Education

Bachelor's degree in Cybersecurity or related field

Professional certifications (CISSP, CISM, etc.)

Tools

Governance, Risk, and Compliance (GRC) tools

Job description

Third Party Security Risk Manager (m/f/d)

The Third Party Security Risk Manager is responsible for managing and overseeing the organization's Third‑Party Security Risk Management (TPSRM) program. This role ensures that vendors, suppliers, partners, and external service providers meet JTI's cybersecurity, compliance, and risk management requirements while supporting business operations and regulatory obligations.

Responsibilities

• Third‑Party Risk Assessment and Due Diligence
  • Conduct cybersecurity risk assessments for third‑party vendors, suppliers, and service providers.
  • Evaluate vendor security posture during onboarding, renewal, and ongoing monitoring activities.
  • Review security questionnaires, audit reports, certifications, and supporting documentation.
  • Assess vendor controls against internal security standards and industry frameworks.
  • Identify inherent and residual risks associated with third‑party engagements.
• Security Governance and Compliance
  • Ensure third‑party compliance with applicable cybersecurity frameworks, regulations, and policies including ISO 27001, NIST, SOC 2, GDPR, PCI‑DSS, etc. where applicable.
  • Support internal and external audit activities related to vendor security risk management.
  • Maintain and improve third‑party security policies, standards, procedures, and governance processes.
  • Ensure vendor risk activities align with enterprise risk management objectives.
• Risk Mitigation and Issue Management
  • Document identified security risks, gaps, and control deficiencies.
  • Work with vendors and internal stakeholders to define remediation plans and mitigation strategies.
  • Track remediation progress and validate closure of identified issues.
  • Escalate high‑risk findings and unresolved issues to leadership as appropriate.
  • Support ongoing monitoring of vendor cybersecurity risks and emerging threats.
• Stakeholder and Vendor Management
  • Coordinate phishing simulation and social engineering exercises.
  • Use simulation outcomes to improve learning, communications, and engagement.
  • Partner with cyber teams to align campaigns to emerging threats.
  • Measure behavior change and security culture maturity.
• Stakeholder Collaboration, Influence & Continuous Improvements
  • Partner with Procurement, Legal, Compliance, Privacy, Digital & IT, and business teams throughout the vendor lifecycle.
  • Provide security risk guidance during vendor selection, contract negotiations, and renewals.
  • Communicate assessment results and risk recommendations to technical and non‑technical stakeholders.
  • Build effective working relationships with internal teams and external vendors.
• Reporting, Metrics, and Program Management
  • Maintain accurate vendor risk records, inventories, and assessment documentation.
  • Develop and deliver risk metrics, dashboards, and reporting for management and governance committees.
  • Support continuous improvement of the Third‑Party Security Risk Management program.
  • Assist in developing strategic initiatives to enhance vendor risk oversight and operational efficiency.

Requirements

• Bachelor's degree in Cybersecurity, Information Security, Information Technology, Risk Management, or a related field.
• Professional certifications such as CISSP, CISM, CRISC, CISA, or CCSP.
• Strong understanding of cybersecurity frameworks and standards including NIST, ISO 27001, SOC 2, CIS Controls, GDPR, etc.
• Minimum of 5 years of experience in cybersecurity, risk management, compliance, audit, or third‑party/vendor risk management.
• Experience working with Governance, Risk, and Compliance (GRC) tools and vendor risk management platforms.
• Experience supporting cloud security assessments and SaaS vendor evaluations.
• Experience conducting security assessments and evaluating vendor security controls.
• Fluent English written and spoken.
• Strong analytical and risk assessment skills.
• Excellent written and verbal communication abilities.
• Ability to communicate technical concepts to non‑technical audiences.
• Strong organizational and stakeholder management skills.
• Ability to manage multiple priorities in a fast‑paced environment.
• Sound judgment and risk‑based decision‑making capabilities.

At JTI, we strive to create a diverse and inclusive work environment. As an equal‑opportunity employer, we welcome applicants from all backgrounds. If you need any specific support, alternative formats, or have other access requirements, please let us know.