Starszy specjalista lub Starsza specjalistka ds. ryzyka, zgodności i ciągłości działania

Diagnostyka S.A. offers a position based in Kraków focused on cybersecurity risk, compliance, and business continuity management. The company manages risks and compliance with standards like NIS2, ISO/IEC 27001, ISO 22301, ISO/IEC 27799, and RODO. The role involves cooperation with ICT supply chain risk management and supports a secure environment within a healthcare context.

• Knowledge of ICT supply chain risk management (C-SCRM) and NIS2/KSC requirements for supplier and third-party security.
• Knowledge of cybersecurity risk management principles, risk analysis methods, and risk treatment (NIST RMF, ISO/IEC 27005).
• Familiarity with NIS2 directive and Cybersecurity Act (KSC), including obligations of key and critical entities.
• Knowledge of ISO/IEC 27001, ISO 22301 (business continuity), ISO/IEC 27799 (health information security), and GDPR.
• Understanding of business continuity planning, impact analysis (BIA), and recovery strategies.
• Familiarity with security audit compliance controls and assessment processes.
• Knowledge of healthcare data processing specifics and requirements for medical systems (LIS, RIS/PACS, HL7, DICOM).
• Ability to perform risk and control effectiveness assessments.
• Ability to develop policies, procedures, and ISMS documentation.
• Ability to interpret regulatory requirements into security requirements.
• Ability to conduct continuity tests and analyze their outcomes.
• Independence in performing complex tasks and skills in mentoring and shaping standards.
• Held certifications: CRISC, CISA, ISO/IEC 27005 Lead Auditor, ISO/IEC 22301 Lead Auditor, CBCP (business continuity).

• Perform cybersecurity risk analyses and assessments for systems, services, and processes and recommend risk mitigation actions.
• Evaluate effectiveness of management, operational, and technical controls in information systems.
• Maintain risk registers and risk treatment plans; monitor accepted risks.
• Develop, maintain, and review security policies, standards, and procedures compliant with NIS2, KSC law, ISO/IEC 27001, and GDPR.
• Monitor compliance with legal, regulatory, and contractual requirements; prepare for audits and inspections by cybersecurity authorities.
• Develop and maintain Business Impact Analysis (BIA), Business Continuity Plans (BCP), and Disaster Recovery Plans (DRP).
• Plan, conduct, document continuity and recovery plan tests and implement audit recommendations.
• Coordinate incident reporting to relevant CSIRT and authorities within NIS2/KSC timelines.
• Manage ICT supply chain risk including security assessments of suppliers and group entities.
• Collaborate with process and system owners to implement controls and assess new services compliance at design stage.
• Enhance maturity of Information Security Management System (ISMS) and Business Continuity System (BCS).
• Prepare risk, compliance, and continuity reports for management and company authorities.
• Define security requirements for suppliers and third parties; introduce security clauses into contracts as per NIS2/KSC.
• Conduct periodic assessments, qualifications, and monitoring of key ICT service suppliers and oversee incident reporting obligations (C-SCRM).
• Review quality of work in risk, compliance, and continuity management; provide mentoring to junior team members.
• Participate in defining team standards, procedures, and best practices.

Klikając w przycisk „Wyślij” zgadzasz się na przetwarzanie przez Diagnostyka S.A. Twoich danych osobowych zawartych w zgłoszeniu rekrutacyjnym w celu prowadzenia rekrutacji na stanowisko wskazane w ogłoszeniu.

Administrator danych osobowych to Diagnostyka S.A., ul. prof. M. Życzkowskiego 16, Kraków. Kandydat może kontaktować się w sprawie danych osobowych pod adresami [email protected] i [email protected].

Dane przetwarzane są zgodnie z art. 6 RODO, w celu rekrutacji oraz przyszłych rekrutacji, przez okres 12 miesięcy lub do wycofania zgody. Kandydat ma prawa dostępu, sprostowania, usunięcia, ograniczenia przetwarzania, przenoszenia danych oraz cofnięcia zgody. Może też złożyć skargę do organu nadzorczego (Prezes Urzędu Ochrony Danych Osobowych).