Cyber Governance, Risk & Assurance Analyst

Our Group Cybersecurity Office (GCSO) is responsible for monitoring and coordinating the group wide efforts on Cybersecurity. The main focus is to reduce the risk and likelihood of intrusions and data breaches and therefore enhancing the overall confidentiality, availability and integrity of data for patients, customers and employees.

As a Cyber Governance, Risk & Assurance Consultant within our Group Cybersecurity Office, you will play a pivotal role in operationalizing the Governance, Risk & Assurance processes for the Fresenius Group.

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field
• At least 5 years of experience in cybersecurity governance, risk management, and/or compliance
• Understanding of cybersecurity frameworks, regulations, and industry best practices
• Experience in analyzing cybersecurity controls, risks and vulnerabilities
• Familiarity with third-party risk management processes and methodologies
• Strong analytical, communication, and interpersonal skills
• Relevant certifications such as CISSP, CISM, CRISC, or CISA are a plus
• Ability to work effectively both independently and collaboratively in a dynamic environment

Nice to have:

• Experience with the OneTrust GRC system
• Proficiency in PowerBI
• Knowledge of German language

• Oversight the evolving cyber threat landscape to identify emerging risks
• Conduct thorough cyber risk assessments, both internally and for third-parties
• Development of effective risk treatment plans and monitor their implementation
• Maintenance of a centralized risk register for accurate reporting and management
• Documentation and analysis of the maturity levels of the organization's cybersecurity controls
• Maintenance and improvement of the cybersecurity controls effectiveness metrics framework
• Administration of the Governance, Risk & Assurance solution tools (GRC, Vendor Risk Management, etc.)
• Provision of consultation on cyber risks and mitigation strategies to internal stakeholders