Ework Group
IT Security & Risk Officer Third-Party Risk Management
- Compensation
- Not disclosed
- Location
- Wrocław, Polish
- Work setup
- Hybrid
- Seniority
- Senior
- Employment
- Not specified
- Experience
- 3+ years
- Category
- Security
- Posted
Skills
Must have
- Minimum 5 years of professional experience in cybersecurity, information security, IT risk management or related areas.
- Minimum 3 years of hands-on experience performing third-party security assessments, supplier security reviews, technology risk assessments or similar activities.
- Demonstrated experience analyzing technical and security documentation and translating findings into actionable risk decisions.
- Experience in large enterprise environments with multiple stakeholders and governance processes.
- Experience collaborating with external suppliers and managing security-related discussions and follow-up activities.
- Strong understanding of cybersecurity principles and risk management practices.
- Practical knowledge of TPRM, supply chain security and vendor risk assessment methodologies.
- Experience assessing security controls against recognized frameworks and standards: ISO 27001, NIST Cybersecurity Framework, SOC 2, NIS2, DORA, CIS Controls.
- Understanding of AI governance, AI-related risks and regulatory requirements such as the EU AI Act.
- Experience working with internal corporate security policies, standards and compliance requirements.
- Excellent written and verbal communication skills in English.
Nice to have
- CISSP, SSCP, CISM, CRISC or equivalent cybersecurity certification.
- ISO 27001 Lead Auditor, Lead Implementer or similar audit/compliance certification.
- Experience contributing to the design, implementation or improvement of security governance and risk management processes.
Full description
- For our Client from automotive industry, we are looking for a Senior IT Security & Risk Officer (Third-Party Risk Management) - Wrocław - hybrid work mode (2 days at the office)🔹
Job Description:
You will assess the security posture of external suppliers, products and services , act as a trusted advisor on third-party cybersecurity risks throughout supplier onboarding and lifecycle management, and help develop the Third-Party Risk Management (TPRM) process.
The role covers a broad range of technologies, including SaaS solutions, COTS applications, cloud services, hardware and OT-related solutions, and involves working with international suppliers.
Requirements:
- Minimum 5 years of professional experience in cybersecurity, information security, IT risk management or related areas.
- Minimum 3 years of hands-on experience performing third-party security assessments, supplier security reviews, technology risk assessments or similar activities.
- Demonstrated experience analyzing technical and security documentation and translating findings into actionable risk decisions.
- Experience in large enterprise environments with multiple stakeholders and governance processes.
- Experience collaborating with external suppliers and managing security-related discussions and follow-up activities.
- Strong understanding of cybersecurity principles and risk management practices.
- Practical knowledge of TPRM, supply chain security and vendor risk assessment methodologies.
- Experience assessing security controls against recognized frameworks and standards: ISO 27001, NIST Cybersecurity Framework, SOC 2, NIS2, DORA, CIS Controls.
- Understanding of AI governance, AI-related risks and regulatory requirements such as the EU AI Act.
- Experience working with internal corporate security policies, standards and compliance requirements.
- Excellent written and verbal communication skills in English.
Nice to Have:
- CISSP, SSCP, CISM, CRISC or equivalent cybersecurity certification.
- ISO 27001 Lead Auditor, Lead Implementer or similar audit/compliance certification.
- Experience contributing to the design, implementation or improvement of security governance and risk management processes.