Senior IT Security & Risk Officer

Work model: Hybrid – 2 days per week in the office. (Wrocław)

Responsibilities

• Conduct security risk assessments of third-party suppliers, products and services, including SaaS, cloud, COTS, hardware and OT solutions.

• Review supplier security documentation, identify risks and non-compliance, and provide risk-based recommendations.

• Collaborate with suppliers and internal stakeholders to address security concerns and ensure compliance with corporate requirements.

• Advise procurement, legal, compliance, business and cybersecurity teams on third-party security risks throughout the supplier lifecycle.

• Improve TPRM processes, assessment methodologies and security governance practices.

• Monitor emerging threats, regulations and industry best practices.

Requirements

• Minimum 5 years of experience in cybersecurity, information security or IT risk management.

• At least 3 years of hands-on experience in third-party security assessments or vendor risk management.

• Strong knowledge of cybersecurity, supply chain security, TPRM methodologies and security control frameworks.

• Familiarity with ISO 27001, NIST CSF, SOC 2, NIS2, DORA and CIS Controls.

• Understanding of AI governance, AI-related risks and the EU AI Act.

• Experience working in large enterprise environments and engaging with external suppliers.

• Strong analytical, problem-solving and communication skills, with excellent English proficiency.

Nice to have:

• Certifications such as CISSP, SSCP, CISM, CRISC or equivalent.

• ISO 27001 Lead Auditor or Lead Implementer certification.

• Experience improving security governance and risk management processes.