Third-Party Security Risk Architect

Nokia; Amadora; Presencial; EUR 70 000 - 90 000; Tempo integral

Resumo da oferta

Nokia Information Security invites application for a role in the Third-Party Security team to assess and manage security risks of suppliers, partners, outsourcing providers, and other third parties. You will evaluate controls, document risks, and drive remediation aligned with Nokia requirements to enable secure business growth.

You will collaborate with procurement, legal, compliance, and business owners to define risk treatment, onboard new suppliers, and maintain governance records while

Qualificações

• Minimum 4 to 8 years of experience in cybersecurity, information security, risk management, audit, compliance, or third-party risk management.
• Strong understanding of third-party risk management principles, supplier security assurance, and security governance practices.
• Experience conducting security assessments, control reviews, or risk evaluations in enterprise environments.
• Strong understanding of information security controls and common security domains, including access management, vulnerability management, incident management, data protection, and cloud security.
• Knowledge of security and risk management frameworks such as ISO/IEC 27001, ISO/IEC 27002, ISO 31000, NIST Cybersecurity Framework, CIS Controls, COBIT, and similar industry standards.
• Ability to analyze security risks and communicate findings clearly to both technical and non-technical stakeholders.
• Strong analytical, problem-solving, and critical-thinking capabilities.
• Excellent stakeholder management and collaboration skills.
• Strong written and verbal communication skills in English.
• Master's degree in Cybersecurity, Information Technology, Computer Science, Engineering, Risk Management, or related discipline.

Responsabilidades

• Conducting security assessments of suppliers, service providers, and other third parties using established risk assessment methodologies and security frameworks.
• Reviewing third-party security documentation, certifications, audit reports, and control evidence to evaluate security maturity and compliance with Nokia requirements.
• Identifying security risks and control gaps and documenting impact, likelihood, and recommended remediation actions.
• Assess security risks associated with third parties providing AI-enabled services, cloud-native platforms, and outsourced digital services.
• Working with suppliers and business stakeholders to define, track, and validate risk treatment and remediation plans.
• Supporting supplier onboarding, periodic reassessments, and ongoing security assurance activities throughout the third-party lifecycle.
• Providing risk-based recommendations to business owners, procurement teams, and management to support informed decision-making.
• Maintaining third-party risk records, assessment results, exceptions, and security metrics within designated governance processes and tools.
• Monitoring remediation progress and reporting on outstanding risks, assessment status, key metrics, and trends.
• Supporting the continuous improvement of third-party risk management processes, methodologies, standards, and operating procedures.
• Creating awareness of third-party security risks and promoting security best practices among internal stakeholders and suppliers.
• Collaborating with procurement, legal, compliance, privacy, audit, and Information Security teams to ensure consistent management of third-party security requirements.
• Supporting audit activities, compliance reviews, and regulatory initiatives related to supplier security and third-party risk management.
• Staying informed of emerging cyber threats, vulnerabilities, industry trends, and regulatory developments that may impact supplier security risk exposure.
• Contributing to executive and operational reporting regarding third-party security posture, risks, and remediation progress.

Conhecimentos

Third-party risk management

Supplier security assurance

Security governance

Security assessments

Control reviews

Risk evaluations

Information security controls

Cloud security

Access management

Vulnerability management

Incident management

Data protection

ISO 27001

NIST CSF

CIS Controls

COBIT

English communication

Analytical thinking

Stakeholder management

Formação académica

Master's degree in Cybersecurity, Information Technology, Computer Science, Engineering, Risk Management, or related discipline

Ferramentas

GRC platforms

Security assessment platforms

Vendor risk management tools

Descrição da oferta de emprego

Nokia Information Security invites application for a role in the Third-Party Security team to assess and manage security risks of suppliers, partners, outsourcing providers, and other third parties. You will evaluate controls, document risks, and drive remediation aligned with Nokia requirements to enable secure business growth.

You will collaborate with procurement, legal, compliance, and business owners to define risk treatment, onboard new suppliers, and maintain governance records while