Operational Risk Assessment Analyst

Quick Facts

• Role: Operational Risk Assessment Analyst

• Location: Kraków, Poland (Hybrid – 3 days per week onsite)

• Contract type: B2B

Description

You will evaluate the security posture of third-party vendors that have access to sensitive information or systems. Perform cyber risk assessments to identify security threats and vulnerabilities, recommend risk mitigation strategies, and support compliance with cybersecurity policies and procedures. You will report regular updates on third-party cybersecurity risk and assurance status to committees and management.

Responsibilities

• Conduct risk assessments of third-party vendors to identify security threats and vulnerabilities

• Report ongoing status of third-party cybersecurity risk and compliance issues based on internal/external and regulatory assessments

• Ensure third-party cybersecurity risk assurance plans and execution align with operating procedures and regulatory requirements

• Analyze vendor security controls, policies, and procedures for compliance with regulations and industry best practices

• Develop and implement risk mitigation strategies to reduce organizational exposure

• Communicate findings and recommendations to senior management, legal, and compliance teams

• Monitor and track vendor compliance through cyclical/periodic assessments

• Support improvement of the overall risk assessment process and remediation approach in the CISO/OCRA team

Requirements

• 5+ years of experience in third-party risk assessment or cybersecurity assessment

• Knowledge of regulatory guidelines and requirements (e.g., FRBNY, FINMA, MAS, HKMA, DORA)

• Specialist knowledge in third-to-nth party security risk oversight and assessment

• Knowledge of internal/external and regulator engagements

• Ability to communicate in writing and verbally with business partners and management audiences; strong negotiation and influencing skills

• Knowledge of NIST Cybersecurity Framework and NIST 800 series; familiarity with frameworks such as COBIT/ITIL/ISO

• Information security audit or risk assessment experience in complex IT environments, including cloud technologies (beneficial)

• Proven ability to work independently and in a team in a fast-paced environment

• Flexibility and creative problem-solving

• Strong analytical, decision-making, and problem-solving skills

• Dedication to fostering an inclusive culture and valuing diverse perspectives

Benefits

• Hybrid work model (3 days onsite per week)

• B2B contract role