Security Assessor

The role is within the Global Security – Information Security Governance / Third-Party Risk Management (TPRM) department, focused on supplier security assessments and managing third-party risks in the retail / e-commerce industry. The position is based in Warsaw, Poland, and reports to the Manager of Information Security Governance.

• Minimum 2 years of experience in Third-Party Risk Management (TPRM), Information Security, Cybersecurity Risk Management, or IT Audit / Governance, Risk, and Compliance (GRC).
• Experience performing vendor or supplier security assessments.
• Strong understanding of information security principles and control domains including Access Management, Vulnerability Management, Incident Response, Business Continuity, Security Monitoring, and Data Protection.
• Experience reviewing security questionnaires and industry-standard assurance reports such as SOC 2, ISO 27001, CAIQ, and SIG.
• Excellent written and verbal communication skills in English.

Nice to have:

• Relevant certifications including CRISC, CISA, CISSP, ISO 27001 Lead Auditor, CTPRP.
• Experience with security governance, supplier risk management, or GRC platforms.
• Experience working in an international and cross-functional environment.
• Knowledge of privacy and data protection requirements related to third-party services.

Supplier Security Assessments:

• Conduct information security assessments of new and existing suppliers.
• Review supplier responses, security documentation, certifications, audit reports, and evidence.
• Evaluate supplier security posture and identify potential risks and control gaps.
• Provide risk-based recommendations to business stakeholders and project teams.
• Support assessment prioritization based on supplier criticality and risk exposure.

Reassessments and Ongoing Monitoring:

• Execute periodic reassessments of suppliers according to established risk-based cycles.
• Follow up with suppliers regarding overdue assessments and remediation activities.
• Support tracking of reassessment deadlines and escalation processes.
• Contribute to continuous monitoring activities and review of security posture changes.

Stakeholder and Supplier Engagement:

• Serve as a security point of contact for internal business stakeholders and suppliers.
• Clearly communicate security requirements and assessment outcomes.
• Facilitate meetings and discussions related to supplier security concerns.
• Support resolution of assessment findings and clarification requests.

Process and Documentation Support:

• Maintain accurate records of assessments, findings, and decisions within TPRM tools.
• Support the quality and consistency of assessment documentation.
• Identify opportunities to improve assessment processes, templates, and workflows.
• Assist with audit evidence collection and reporting activities when required.