Cybersecurity Specialist

We’re looking for a Cybersecurity Specialist to join the client team. The person will execute third-party cyber assurance activities within the Control Tower to help ensure compliance for third parties. The role is primarily operational, focused on supplier risk assessments, due diligence validation, mitigation follow-up, and audit-ready evidence, while also supporting OpCo rollouts, process improvements, templates, reporting, and cross-domain ways of working. The specialist is expected to bring a proactive mindset and collaborate with the broader Control Tower to consider third-party risk holistically, not only from a cyber perspective.

What you will do:

• Assess Supplier Cyber Risk

  • Analyse supplier screening, due diligence, questionnaire, evidence, and monitoring outputs to identify cyber risks.

  • Assess risk severity based on business criticality, data sensitivity, system access, operational dependency, and input from other risk domains.

• Execute NIS2-Aligned Due Diligence

  • Perform supplier cyber assurance activities in line with the TPRM process, NIS2 expectations, and internal control requirements.

  • Review supplier evidence such as security certifications, assurance reports, cyber policies, incident response, continuity, and vulnerability management information.

• Manage Mitigation and Follow-Up

  • Translate identified gaps into clear mitigation actions, owners, timelines, and acceptance criteria.

  • Track supplier commitments and coordinate follow-up with Procurement, Cybersecurity, business owners, suppliers, and relevant Control Tower risk domain specialists.

• Maintain Evidence and Risk Records

  • Document assessments, findings, risk decisions, approvals, exceptions, mitigation actions, and supporting evidence in the TPRM tooling.

  • Ensure records are complete, consistent, traceable, and ready for control testing, audit, or regulatory review.

• Monitor, Report, and Escalate Risk

  • Monitor supplier risk status, overdue actions, reassessment dates, open findings, exceptions, and key risk indicators.

  • Provide structured updates and escalate material risks, unresolved gaps, or required risk acceptances to the relevant governance forums.

• Support Rollout and Continuous Improvement

  • Support OpCo rollouts, onboarding, and adoption of the TPRM process, templates, reporting, and ways of working.

  • Work proactively with the broader Control Tower to improve templates, controls, tooling, reporting, and cross-domain risk alignment.

What you will bring:

• Education: Bachelor’s degree in Cybersecurity, Information Security, Risk Management, IT, Business Administration, or a related field

• Experience: Minimum 2-3 years in cybersecurity, IT risk, third-party risk, supplier assurance, audit, compliance, or related roles, and/or relevant certifications

• Risk mindset: Practical understanding of supplier cyber assessments, control evidence, mitigation tracking, and broader third-party risk management

• Strong analytical, documentation, and stakeholder management skills

• Ability to translate risk findings into clear actions, decisions, and improvement opportunities

• Confidence in challenging incomplete supplier evidence constructively

• Clear communication skills with ability to explain cyber and third-party risks in business language

• Proactive mindset with the ability to look beyond the written scope and contribute to rollout, adoption, and process maturity

• Able to manage multiple assessments and prioritize based on risk, urgency, and business impact.

Nice to have:

• Knowledge of NIS2, ISO 27001, SOC 2, NIST CSF, CIS Controls, DORA, GDPR, or similar frameworks.

• Experience with GRC, TPRM, supplier risk, procurement, contract lifecycle tooling, or OpCo/process rollouts.

• ·Relevant certification such as CISA, CISM, CRISC, CISSP, ISO 27001, or equivalent.

What we offer:

• Fully remote work

• Flexibility of a B2B contract

• Professional development opportunities

• People-centric culture

• Regular company events