IT Security & Risk Officer

🔹 For our Client from automotive industry, we are looking for a Senior IT Security & Risk Officer (Third-Party Risk Management) - Wrocław - hybrid work mode (2 days at the office)🔹

Job Description

You will assess the security posture of external suppliers, products and services, act as a trusted advisor on third-party cybersecurity risks throughout supplier onboarding and lifecycle management, and help develop the Third-Party Risk Management (TPRM) process.

The role covers a broad range of technologies, including SaaS solutions, COTS applications, cloud services, hardware and OT-related solutions, and involves working with international suppliers.

Responsibilities:

• Perform security risk assessments of third-party suppliers, products and services (SaaS, COTS, cloud, hardware, OT-related solutions).
• Review supplier responses, technical documentation, security reports and supporting evidence to evaluate security posture and identify potential risks.
• Analyze identified risks, address points of non-compliance and provide clear, risk-based recommendations.
• Engage directly with suppliers and internal stakeholders to clarify security, compliance and risk-related matters.
• Act as a trusted advisor on third-party cybersecurity risks during supplier onboarding and throughout the supplier lifecycle.
• Collaborate with procurement, legal, compliance, business and cybersecurity teams to ensure security requirements are properly addressed, and align assessments with internal security standards, policies and corporate requirements.
• Drive continuous improvement of the TPRM process, methodologies and assessment practices: identify process gaps and inefficiencies, then propose and implement corrective actions.
• Monitor emerging threats, regulatory requirements and industry best practices to keep the assessment framework effective and up to date.

Requirements:

• Minimum 5 years of professional experience in cybersecurity, information security, IT risk management or related areas.
• Minimum 3 years of hands-on experience performing third-party security assessments, supplier security reviews, technology risk assessments or similar activities.
• Demonstrated experience analyzing technical and security documentation and translating findings into actionable risk decisions.
• Experience in large enterprise environments with multiple stakeholders and governance processes.
• Experience collaborating with external suppliers and managing security-related discussions and follow-up activities.
• Strong understanding of cybersecurity principles and risk management practices.
• Practical knowledge of TPRM, supply chain security and vendor risk assessment methodologies.
• Experience assessing security controls against recognized frameworks and standards: ISO 27001, NIST Cybersecurity Framework, SOC 2, NIS2, DORA, CIS Controls.
• Understanding of AI governance, AI-related risks and regulatory requirements such as the EU AI Act.
• Experience working with internal corporate security policies, standards and compliance requirements.
• Excellent written and verbal communication skills in English.

Way of Working:

• Strong analytical, problem-solving and critical-thinking skills.
• Comfortable acting as a trusted advisor and navigating complex enterprise environments with many stakeholders.
• Ability to work with international suppliers and communicate clearly in English, both in writing and verbally.

Nice to Have:

• CISSP, SSCP, CISM, CRISC or equivalent cybersecurity certification.
• ISO 27001 Lead Auditor, Lead Implementer or similar audit/compliance certification.
• Experience contributing to the design, implementation or improvement of security governance and risk management processes.

We offer:

• B2B agreement
• Transparent working conditions with both Ework and the client
• Current support during our cooperation
• Possibility to work in an international environment
• Collaborative environment in Swedish organizational culture
• Private medical care
• Life insurance
• Multisport
• Teambuilding events

Client code: MM03, MO02

Contact person: nicola.urbanska@eworkgroup.com