Operational Risk assessment Analyst

Job Title: Operational Risk assessment Analyst

Location: Krakow, Poland (Hybrid – 3 days in a week to onsite)

Job Type: B2B Contract

Job Description:

Your role :

You will be responsible for evaluating the security posture of third-party vendors that have access to sensitive information or systems of. You will conduct risk assessments to identify and evaluate potential security threats posed by third-party vendors and recommend risk mitigation strategies to minimize the organization's exposure to cyber threats. You will also work closely with internal stakeholders to ensure that third-party vendors comply with our cybersecurity policies and procedures.

We are looking for candidates who have experience in the following areas:

• Conduct risk assessments of third-party vendors to identify potential security threats and vulnerabilities;

• Reporting regular updates to relevant committees and management teams on the status of 3rd party Cybersecurity risk and compliance issues based on internal/external & regulatory assessment results

• Ensure that 3rd party Cybersecurity risk assurance approach, plans and execution are aligned with standard operating policies and procedures, risk assurance standards and regulatory requirements

• Analyze and evaluate vendor security controls, policies, and procedures to ensure compliance with regulatory requirements and industry best practices;

• Develop and implement risk mitigation strategies to address identified vulnerabilities and reduce the organization's exposure to cyber threats;

• Communicate assessment findings and recommendations to internal stakeholders, including senior management, legal, and compliance teams;

• Monitor and track vendor compliance with security policies and procedures through cyclical/periodic assessment activities;

• You’ll be working in the CISO/OCRA (Operational Consolidate Risk assessment) team in Poland. You'll take a part in supporting colleagues from different areas of the firm, including Risk Taxonomy Owners, Compliance & Operational Risk Controllers and Outsourcing & Supplier Management, in improving the overall risk assessment process and implementing the most effective remediation measures.

You have:

• Knowledge in regulatory guidelines and requirements: FRBNY, FINMA, MAS, HKMA, DORA etc.

• Knowledge and specialist in 3rd to Nth party security risk oversight and assessment

• Knowledge on internal / external and regulator engagements

• Cyber and Information security or data privacy related certifications (e.g. CISSP, CISM, CISA or CRISC) are an advantage.

• Ability to communicate both written and verbal for business key partners and management audience. Excellent negotiation, influencing and analytical skills are highly desired

• Knowledge in NIST Cybersecurity Framework and NIST 800 series documents and other such related frameworks: COBIT/ITIL/ISO

• Information Security audit or risk assessment experience in complex IT environments, including Cloud technologies would be beneficial.

• Proven ability to work both independently and as part of a team to deliver quality work in a fast-paced environment

• Flexibility and ability to think creatively and to identify new ways to approach old problems

• Phenomenal analytical, decision-making, and problem-solving skills

• Dedication to fostering an inclusive culture and value varied perspectives.

• 5+ years of experience in third-party risk assessment or cybersecurity assessment;

• Certifications such as Certified Third-Party Risk Professional (CTPRP) or Certified Information Systems Security Professional (CISSP) are a plus.