Third-Party Cybersecurity Risk Specialist

About the Role

We are seeking an experienced Third-Party Cybersecurity Risk Specialist to evaluate the security posture of external service providers, SaaS vendors, and technology partners for a premier global alternative investment firm. In this role, you will evaluate technical security controls, analyze architectural data flows, review third-party audit reports and penetration tests, and support risk management decisions across a complex enterprise environment. You will partner with IT, Legal, Compliance, and Procurement teams to identify vulnerabilities, assess business impact, and track remediation plans.

Key Responsibilities

• Conduct comprehensive technical security reviews of external vendors, SaaS providers, and third-party technology partners.
• Evaluate security controls, technical architectures, data flows, and system integrations to identify potential security risks.
• Review third-party audit documentation, SOC 2 reports, ISO certifications, penetration test results, and vulnerability assessments.
• Assess technical security measures across cloud environments, access management (IAM), networks, application security, and incident response.
• Identify control gaps, validate findings with key stakeholders, and evaluate proposed remediation actions.
• Prepare structured risk assessment reports detailing findings, business impact, and mitigation recommendations.
• Partner with IT, Information Security, Legal, Compliance, and Procurement teams to govern vendor security lifecycles.
• Support continuous enhancements to assessment workflows, reporting standards, and risk methodologies.
• Monitor emerging cyber threats, industry standards, and regulatory expectations.

Candidate Profile

• Level of Experience: 5+ years of hands-on experience in cybersecurity, technology risk, security engineering, or third-party risk management (TPRM).
• Technical Assessment Skills: Proven track record of evaluating technical security controls, interpreting penetration test results, and assessing architectural data flows.
• Domain Knowledge: Strong understanding of cloud security (AWS / Azure / GCP), SaaS solutions, IAM, network defense, vulnerability management, and data protection.
• Security Frameworks: Practical familiarity with established security frameworks and standards, such as NIST CSF, NIST SP 800-53, ISO 27001, and SOC 2.
• Communication & Collaboration: Excellent analytical and communication skills, with the ability to convey complex technical risks clearly to both technical and business audiences.
• Education & Ethics: Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or a related field; high commitment to professional ethics and confidentiality.

Nice to Have

• Recognized security certifications (such as CISSP, CISA, CRISC, CISM, or CCSP).
• Experience within financial services, investment banking, asset management, or other highly regulated environments.
• Familiarity with third-party risk management platforms (such as OneTrust, ProcessUnity, Archer, or Prevalent).

Working Model & Logistics

• Employment Type: Employment Contract (UoP)
• Location: Warsaw, Poland (Hybrid model - 3 days per week form office)