Operational Consolidate Risk assessment (OCRA) Lead

We are looking for candidates who have experience as Third party Cyber & Information Security analyst:

Responsibilities:

• Conduct risk assessments of third-party vendors to identify potential security threats and vulnerabilities;
• Reporting regular updates to relevant committees and management teams on the status of 3rd party Cybersecurity risk and compliance issues based on internal/external & regulatory assessment results
• Ensure that 3rd party Cybersecurity risk assurance approach, plans and execution are aligned with standard operating policies and procedures, risk assurance standards and regulatory requirements
• Analyze and evaluate vendor security controls, policies, and procedures to ensure compliance with regulatory requirements and industry best practices;
• Develop and implement risk mitigation strategies to address identified vulnerabilities;
• Communicate assessment findings and recommendations to internal stakeholders, including senior management, legal, and compliance teams;
• Monitor and track vendor compliance with security policies and procedures through cyclical/periodic assessment activities;

You’ll be working in the CISO/OCRA (Operational Consolidate Risk assessment) team in Poland. You'll take a part in supporting colleagues from different areas of the firm, including Risk Taxonomy Owners, Compliance & Operational Risk Controllers and Outsourcing & Supplier Management, in improving the overall risk assessment process and implementing the most effective remediation measures.

Required skills:

• Knowledge in regulatory guidelines and requirements: FRBNY, FINMA, MAS, HKMA, DORA etc.
• Knowledge and specialist in 3rd to Nth party security risk oversight and assessment
• Knowledge on internal / external and regulator engagements
• Cyber and Information security or data privacy related certifications (e.g. CISSP, CISM, CISA or CRISC) are an advantage.
• Ability to communicate both written and verbal for business key partners and management audience. Excellent negotiation, influencing and analytical skills are highly desired
• Knowledge in NIST Cybersecurity Framework and NIST 800 series documents and other such related frameworks: COBIT/ITIL/ISO
• Information Security audit or risk assessment experience in complex IT environments, including Cloud technologies would be beneficial.
• Proven ability to work both independently and as part of a team to deliver quality work in a fast-paced environment
• Flexibility and ability to think creatively and to identify new ways to approach old problems
• Phenomenal analytical, decision-making, and problem-solving skills
• Dedication to fostering an inclusive culture and value varied perspectives.
• 5+ years of experience in third-party risk assessment or cybersecurity assessment;
• Certifications such as Certified Third-Party Risk Professional (CTPRP) or Certified Information Systems Security Professional (CISSP) are a plus.

B2B Contract Hybrid work (3 days weekly) at Krakow location

Interested candidates, feel free to apply with your CV

Warm regards, Dewakar.

O, Infoplus Technologies