Third Party Security Analyst

Nokia Global; Portugal; On-site; EUR 45,000 - 65,000; Full time

Job summary

A Nokia Global está à procura de um analista de segurança de terceiros para avaliar e gerir riscos associados a fornecedores, parceiros e prestadores. O papel envolve conduzir avaliações de segurança, revisar evidências de controles e apoiar governança de risco ao longo do ciclo de vida dos terceiros.

O candidato ideal possui experiência em gestão de risco de terceiros, certificações relevantes e fluência em inglês, com mestrado em áreas relacionadas.

Qualifications

• Mínimo 4 a 8 anos de experiência em cibersegurança, gestão de informações, ou gestão de risco de terceiros.
• Compreensão sólida de princípios de gestão de risco de terceiros, garantia de segurança de fornecedores e governança de segurança.
• Experiência em avaliações de segurança, revisões de controles ou avaliações de risco em ambientes empresariais.
• Conhecimento de controles de segurança e domínios comuns, incluindo gestão de acesso, gestão de vulnerabilidades, gestão de incidentes, proteção de dados, e segurança em nuvem.
• Conhecimento de estruturas de segurança e gestão de risco como ISO 27001, ISO 27002, ISO 31000, NIST CSF, CIS Controls, COBIT.
• Capacidade de analisar riscos de segurança e comunicar resultados a partes técnicas e não técnicas.
• Fortes capacidades analíticas, de resolução de problemas e pensamento crítico.
• Excelentes habilidades de gestão de stakeholders e colaboração.
• Forte comunicação escrita e verbal em inglês.
• Mestrado em Cybersegurança, Tecnologia da Informação, Ciência da Computação, Engenharia, Gestão de Risco, ou área relacionada.

Responsibilities

• Conduzir avaliações de segurança de fornecedores, prestadores e terceiros usando metodologias de avaliação de risco e estruturas de segurança estabelecidas.
• Revisar documentação de terceiros, certificações, relatórios de auditoria e evidência de controles para avaliar maturidade de segurança.
• Identificar riscos de segurança e lacunas de controles, documentando impacto, probabilidade e ações de remediação.
• Avaliar riscos de segurança de terceiros que fornecem serviços com IA, plataformas nativas da nuvem e serviços digitais terceirizados.
• Trabalhar com fornecedores e partes interessadas para definir, acompanhar e validar planos de tratamento de risco.
• Suportar onboarding de fornecedores, reavaliações periódicas e atividades de garantia de segurança ao longo do ciclo de vida do fornecedor.
• Fornecer recomendações com base no risco a proprietários de negócios, equipes de compras e gestão.
• Manter registros de terceiros, resultados de avaliações, exceções e métricas de segurança em processos de governança.
• Monitorar progresso de remediação e relatar riscos pendentes, status de avaliação, métricas e tendências.
• Apoiar melhoria contínua de processos, metodologias, padrões e procedimentos operacionais de gestão de terceiros.
• Criar awareness sobre riscos de terceiros e promover boas práticas de segurança entre stakeholders internos e fornecedores.
• Colaborar com equipes de compras, jurídica, conformidade, privacidade, auditoria e Segurança da Informação para gestão consistente de requisitos de segurança de terceiros.
• Apoiar atividades de auditoria, revisões de conformidade e iniciativas regulatórias relacionadas à segurança de fornecedores e gestão de risco de terceiros.
• Manter-se informado sobre ameaças cibernéticas emergentes, vulnerabilidades, tendências setoriais e desenvolvimentos regulatórios.

Skills

Risco de terceiros

Gestão de riscos

Auditoria de segurança

Controles de segurança

Comunicação em inglês

Análise de riscos

Education

Mestrado em Cybersegurança

Tools

GRC platforms

Job description

Third Party Security Analyst

Empresa : Nokia Global

Tipo de Emprego : Periodo Integral

Portugal

Descrição do Emprego - Third Party Security Analyst

Description

Information Security serves as Nokia's center of excellence for cybersecurity, responsible for defining security policies and standards, shaping the cybersecurity architecture and roadmap, and overseeing security monitoring, detection, and incident management. We actively partner with Nokia's Business Segments and Business Functions to protect critical information, strengthen third-party security, and support compliance with internal and external security requirements.

In this role, you will join the Third-Party Security team, which is responsible for assessing and managing security risks associated with suppliers, partners, outsourcing providers, and other third parties. The team works closely with procurement, legal, business owners, suppliers, and Information Security stakeholders to ensure third-party relationships meet Nokia's security expectations and risk tolerance while supporting business objectives.

As a trusted security professional, you will evaluate supplier security controls, identify and assess risks, recommend remediation actions, and support ongoing security governance and assurance activities. You will help ensure that third-party security risks are effectively managed throughout the supplier’s lifecycle and that security remains an enabler of business growth and operational resilience.

Responsibilities

• Conducting security assessments of suppliers, service providers, and other third parties using established risk assessment methodologies and security frameworks.
• Reviewing third-party security documentation, certifications, audit reports, and control evidence to evaluate security maturity and compliance with Nokia requirements.
• Identifying security risks and control gaps and documenting impact, likelihood, and recommended remediation actions.

• Assess security risks associated with third parties providing AI-enabled services, cloud-native platforms, and outsourced digital services.

• Working with suppliers and business stakeholders to define, track, and validate risk treatment and remediation plans.
• Supporting supplier onboarding, periodic reassessments, and ongoing security assurance activities throughout the third-party lifecycle.
• Providing risk-based recommendations to business owners, procurement teams, and management to support informed decision-making.
• Maintaining third-party risk records, assessment results, exceptions, and security metrics within designated governance processes and tools.
• Monitoring remediation progress and reporting on outstanding risks, assessment status, key metrics, and trends.
• Supporting the continuous improvement of third-party risk management processes, methodologies, standards, and operating procedures.
• Creating awareness of third-party security risks and promoting security best practices among internal stakeholders and suppliers.
• Collaborating with procurement, legal, compliance, privacy, audit, and Information Security teams to ensure consistent management of third-party security requirements.
• Supporting audit activities, compliance reviews, and regulatory initiatives related to supplier security and third-party risk management.
• Staying informed of emerging cyber threats, vulnerabilities, industry trends, and regulatory developments that may impact supplier security risk exposure.
• Contributing to executive and operational reporting regarding third-party security posture, risks, and remediation progress.

Qualifications

You have:

• Minimum 4 to 8 years of experience in cybersecurity, information security, risk management, audit, compliance, or third-party risk management.
• Strong understanding of third-party risk management principles, supplier security assurance, and security governance practices.
• Experience conducting security assessments, control reviews, or risk evaluations in enterprise environments.
• Strong understanding of information security controls and common security domains, including access management, vulnerability management, incident management, data protection, and cloud security.
• Knowledge of security and risk management frameworks such as ISO/IEC 27001, ISO/IEC 27002, ISO 31000, NIST Cybersecurity Framework, CIS Controls, COBIT, and similar industry standards.
• Ability to analyze security risks and communicate findings clearly to both technical and non-technical stakeholders.
• Strong analytical, problem‑solving, and critical‑thinking capabilities.
• Excellent stakeholder management and collaboration skills.
• Strong written and verbal communication skills in English.
• Master's degree in Cybersecurity, Information Technology, Computer Science, Engineering, Risk Management, or related discipline.

It Would Be Nice If You Also Had

• Experience working with supplier security assessment platforms and GRC solutions.
• Knowledge of cloud security concepts and security assessments of SaaS, PaaS, and IaaS providers.
• Experience in telecommunications, technology, or large multinational organizations.
• Knowledge of data protection and privacy requirements affecting third-party engagements.
• Relevant certifications such as CISSP, CISM, CRISC, ISO 27001 Lead Implementer/Auditor, or equivalent.
• Experience working in global, matrixed organizations.

You Are

• A trusted security professional with a strong risk‑management mindset.
• Customer‑focused and capable of building constructive relationships with internal and external stakeholders.
• Highly organized, self‑motivated, and proactive.
• Comfortable managing multiple assessments and priorities simultaneously.
• An effective communicator who can translate technical risks into business‑relevant recommendations.
• A collaborative team player who works effectively across diverse and virtual teams.
• Focused on delivering practical, sustainable, and risk‑based security outcomes.

Sobre a empresa

Nokia Global

Advancing connectivity to secure a brighter world. Nokia is a global leader in connectivity for the AI era. With expertise across fixed, mobile and transport networks, powered by the innovation of Nokia Bell Labs, we’re advancing connectivity to secure a brighter world. Learn more about life at Nokia...