Senior Analyst - Information Security Risk

CTO develops and runs the groupwide Information Technology (IT) infrastructure, develops and operates innovative IT products, and offers services to the rest of the Group upon which they can build. The CTO area plays a significant role in achieving the Group's strategic goals by leading transformation and supporting a stable operating environment. The Transformation Office unit supplies reliable project management capabilities and information security management to the CTO and enables the other delivery units within the area to roll out IS compliance requirements and Group IS strategy. The successful candidate will join the Information Security, Risk, and Regulatory unit and support in carrying out these responsibilities.

The core responsibilities for the job include the following:

Risk Assessment and Analysis:

• Support CTO teams in conducting regular risk assessments by guiding them through the process.
• Supervise risk tickets and coordinate with application/asset owners to raise extension or closure requests to avoid overdue items.
• Assist application/asset owners in creating ad hoc risk entries, handling risks, and closing them.

Reporting and Monitoring:

• Prepare and present risk status reports to various stakeholders.
• Track and report metrics related to risk exposure and remediation progress.
• Support the creation and operation of the Unit Information Security Committee.
• Maintain and update the knowledge database in Confluence.

Requirements:

• Bachelor's degree in computer science, cybersecurity, information systems, or a related field.
• 1-3 years of experience in information security or risk management
• Strong understanding of risk assessment concepts (risk mitigation, acceptance, avoidance, threat modelling, and CIA triad).
• Structured with strong problem-solving abilities and an analytical mindset.
• Effective communication and stakeholder management skills.
• Preferable knowledge of information security frameworks (ISO 27001 NIST).
• Certifications such as CISM, CRISC, CISA, and CompTIA Security+ are a plus.