IT and Cyber Third-party Risk Assessor

• Proposition or validation of measures to mitigate risks.
• Creation of detailed or synthetic risk report, structured and formulated in line with the company and Information Security Risk Management best practices.
• Support in increasing risk control maturity by providing a valuable follow up and reporting.

– you report risks and overall risk posture regarding Third-parties to Information Security, IT or Business Management

• Correlate risks across a portfolio of projects or activities; identify and propose transversal risk mitigating actions.
• Create risk dashboards and reports for a management audience.
• Create one-pagers and synthetic risk reports for a management audience.

– you manage customer relationship and are the Single Point Of Contact for the risk management services you delivered. You customize services to meet customer needs or expectations while ensuring compliance with risk management methodologies and guidelines of company.
– you contribute to definition and improvement of risk management methods and tools supporting those activities (risk identification guide, risk evaluation matrix, industrialization of risk monitoring and reporting framework and deliverables) taking into account your field experience as well as best practices coming from the company or other sources like regulators, Basel II, CobIT, ISO27000/31000 …
– you contribute to writing processes and procedures supporting risk management activities outlined above, for both an expert and non-expert audience. Experience on linking different ISMS processes is a must.
– you are the single point of contact for security matters related to the CIAT of our assets: business support, maintenance of procedures and tooling, regular reporting, integration of the security asset management in the overall asset management processes of the bank.
– you review IT and security contractual clauses for suppliers servicing bank activities;

• Professional experience in information security (5+ years)
• Experience in process design and improvement
• Experience in Third-party IT and security assessments
• Experience in Data protection, Business continuity, Access management
• Experience in delivering presentations and training

• Significant experience in operational/security risks management.
• Knowledge of control frameworks and audit methodologies.
• Significant experience in working with cloud services (SaaS, HSP, AWS)
• Knowledge of software development security best practices
• Experience in release management, change management, incident management, testing.

• Security certifications like CISSP, CISM, CIPP, CCSK.
• Experience with RSA Archer tool.
• Experience in vulnerability management and penetration testing

• Knowledge of Information Security and Risk Management frameworks (ISO27001, SOC, NIST, OWASP, etc.)
• Professional experience in information security (5+ years), particularly in Third-party management
• Strong IT background.
• Professional experience in Financial Services. used to work in large companies.
• Experience in reviewing and amending Third-party security clauses in contracts.

• Experience in banking environment.

• High performer
• Autonomy, commitment and perseverance in personal organization.
• Quick self-starter, pro-active attitude, team player.
• Results-oriented, responsible for his/her tasks, resourceful.
• Excellent English writing skills.
• Good communication and influencing skills.
• Good analytical and synthesis skills, ability to produce structured and concise documents, be precise and methodological.
• Ability to work in a dynamic and multi-cultural environment.
• Accurate & control minded, but flexible.
• Ability to capture and adapt to stakeholder expectations while respecting processes in place.
• Ability to mentor/coach people.