IT Security & Risk Officer Third-Party Risk Management

For our client from the automotive industry, we are looking for a Senior IT Security & Risk Officer focused on Third-Party Risk Management in Wrocław with hybrid work mode (2 days at the office).

• Minimum 5 years of professional experience in cybersecurity, information security, IT risk management, or related areas.
• Minimum 3 years of hands-on experience performing third-party security assessments, supplier security reviews, technology risk assessments, or similar activities.
• Demonstrated experience analyzing technical and security documentation and translating findings into actionable risk decisions.
• Experience in large enterprise environments with multiple stakeholders and governance processes.
• Experience collaborating with external suppliers and managing security-related discussions and follow-up activities.
• Strong understanding of cybersecurity principles and risk management practices.
• Practical knowledge of TPRM, supply chain security, and vendor risk assessment methodologies.
• Experience assessing security controls against recognized frameworks and standards including ISO 27001, NIST Cybersecurity Framework, SOC 2, NIS2, DORA, CIS Controls.
• Understanding of AI governance, AI-related risks, and regulatory requirements such as the EU AI Act.
• Experience working with internal corporate security policies, standards, and compliance requirements.
• Excellent written and verbal communication skills in English.

Nice to have:

• CISSP, SSCP, CISM, CRISC or equivalent cybersecurity certification.
• ISO 27001 Lead Auditor, Lead Implementer or similar audit/compliance certification.
• Experience contributing to the design, implementation, or improvement of security governance and risk management processes.

• Perform security risk assessments of third-party suppliers, products, and services (SaaS, COTS, cloud, hardware, OT-related solutions).
• Review supplier responses, technical documentation, security reports, and supporting evidence to evaluate security posture and identify potential risks.
• Analyze identified risks, address points of non-compliance, and provide clear, risk-based recommendations.
• Engage directly with suppliers and internal stakeholders to clarify security, compliance, and risk-related matters.
• Act as a trusted advisor on third-party cybersecurity risks during supplier onboarding and throughout the supplier lifecycle.
• Collaborate with procurement, legal, compliance, business, and cybersecurity teams to ensure security requirements are properly addressed.
• Align assessments with internal security standards, policies, and corporate requirements.
• Drive continuous improvement of the TPRM process, methodologies, and assessment practices by identifying process gaps and proposing corrective actions.
• Monitor emerging threats, regulatory requirements, and industry best practices to keep the assessment framework effective and up to date.