Cybersecurity Specialist

We’re looking for a Cybersecurity Specialist to join the client team. The person will execute third-party cyber assurance activities within the Control Tower to help ensure compliance for third parties. The role is primarily operational, focused on supplier risk assessments, due diligence validation, mitigation follow-up, and audit-ready evidence, while also supporting OpCo rollouts, process improvements, templates, reporting, and cross-domain ways of working. The specialist is expected to bring a proactive mindset and collaborate with the broader Control Tower to consider third-party risk holistically, not only from a cyber perspective.

Requirements

What you will do:

- Assess Supplier Cyber Risk

Analyse supplier screening, due diligence, questionnaire, evidence, and monitoring outputs to identify cyber risks.
- Assess risk severity based on business criticality, data sensitivity, system access, operational dependency, and input from other risk domains.

- Execute NIS2-Aligned Due Diligence

Perform supplier cyber assurance activities in line with the TPRM process, NIS2 expectations, and internal control requirements.
- Review supplier evidence such as security certifications, assurance reports, cyber policies, incident response, continuity, and vulnerability management information.

- Manage Mitigation and Follow-Up

Translate identified gaps into clear mitigation actions, owners, timelines, and acceptance criteria.
- Track supplier commitments and coordinate follow-up with Procurement, Cybersecurity, business owners, suppliers, and relevant Control Tower risk domain specialists.

- Maintain Evidence and Risk Records

Document assessments, findings, risk decisions, approvals, exceptions, mitigation actions, and supporting evidence in the TPRM tooling.
- Ensure records are complete, consistent, traceable, and ready for control testing, audit, or regulatory review.

- Monitor, Report, and Escalate Risk

Monitor supplier risk status, overdue actions, reassessment dates, open findings, exceptions, and key risk indicators.
- Provide structured updates and escalate material risks, unresolved gaps, or required risk acceptances to the relevant governance forums.

- Support Rollout and Continuous Improvement

Support OpCo rollouts, onboarding, and adoption of the TPRM process, templates, reporting, and ways of working.
- Work proactively with the broader Control Tower to improve templates, controls, tooling, reporting, and cross-domain risk alignment.

What you will bring:

- Education : Bachelor’s degree in Cybersecurity, Information Security, Risk Management, IT, Business Administration, or a related field
- Experience : Minimum 2-3 years in cybersecurity, IT risk, third-party risk, supplier assurance, audit, compliance, or related roles, and/or relevant certifications
- Risk mindset : Practical understanding of supplier cyber assessments, control evidence, mitigation tracking, and broader third-party risk management
- Strong analytical, documentation, and stakeholder management skills
- Ability to translate risk findings into clear actions, decisions, and improvement opportunities
- Confidence in challenging incomplete supplier evidence constructively
- Clear communication skills with ability to explain cyber and third-party risks in business language
- Proactive mindset with the ability to look beyond the written scope and contribute to rollout, adoption, and process maturity
- Able to manage multiple assessments and prioritize based on risk, urgency, and business impact.

Nice to have:

- Knowledge of NIS2, ISO 27001, SOC 2, NIST CSF, CIS Controls, DORA, GDPR, or similar frameworks.
- Experience with GRC, TPRM, supplier risk, procurement, contract lifecycle tooling, or OpCo/process rollouts.
- ·Relevant certification such as CISA, CISM, CRISC, CISSP, ISO 27001, or equivalent.

What we offer:

- Fully remote work
- Flexibility of a B2B contract
- Professional development opportunities
- People-centric culture
- Regular company events