Cyber Security Governance and Risk Analyst

We're partnering with an integral public service organisation that supports Ireland's healthcare industry and millions of patients across the country.

They're looking for a Cyber Security & Risk Analyst to join them on a 12 month contract, with the possibility of renewal.

The Role

Cyber Security Governance

·Coordinate cyber governance activities across the organisation.

·Support compliance and resilience activities relating to NIS2, CyFun, and other relevant cyber security requirements.

·Prepare cyber governance reports, briefing papers, meeting packs and action trackers for relevant governance groups, including EMT, ARC, Board, programme boards, working groups and IT governance forums.

·Manage cyber and information security policies, standards, procedures, SOPs, guidance documents and supporting templates, including coordinating review and periodic refresh.

·Support rollout and implementation of cyber policies and SOPs across IT and relevant business areas

·Maintain oversight of the cyber remediation plan, including actions, owners, milestones, dependencies, risks, issues, status and evidence of completion.

Cyber Risk Management

·Coordinate the upkeep of the cyber risk register, ensuring risks have clear owners, ratings, treatment plans, target dates and status.

Work with the Risk and Resilience function to ensure cyber risks are reflected in the corporate risk register where appropriate.

·Maintain cyber KPIs, KRIs and management dashboards covering risk exposure, remediation, training, vulnerabilities, incidents, supplier assurance and control maturity.

Incident Response

·Maintain the Major incident response plan and supporting playbooks, escalation paths and contact lists.

·Coordinate cyber incident readiness activities, including tabletop exercises, lessons learned reviews and follow-up action tracking.

·Support incident response planning, evidence gathering, communications, reporting, escalation and post-incident improvement activities.

Security Operations

·Support improvement activities relating to vulnerability management, patch management, secure configuration, logging, monitoring, endpoint protection, malware controls, network security, remote access and identity controls.

·Support development of secure baselines for business-critical systems and track exceptions or overdue remediation items.

Third-Party and Supplier Security Management

·Support cyber security input into supplier onboarding, procurement, contract reviews and supplier assurance activities.

·Coordinate cyber risk assessments for suppliers and third-party service providers.

·Track supplier-related cyber risks, remediation actions, assurance evidence and contractual obligations.

·Support external assurance activities relating to supplier security controls and operational resilience.

Audit and Compliance Support

·Support internal and external audit activities relating to information security, cyber security, resilience and compliance.

·Coordinate evidence gathering, management responses, action tracking and closure evidence for cyber audit findings.

·Monitor cyber security regulatory developments and assess their relevance to the organisation.

Cyber Awareness

·Track completion of cyber training and report on awareness programme performance.

·Promote a strong cyber security culture across the organisation by making cyber responsibilities clear and practical.

·Support targeted cyber training for incident response teams, system owners, IT teams, project teams and business stakeholders.

Stakeholder Management, Communication and Reporting

·Act as a key point of coordination for cyber security matters across the organisation.

·Prepare clear and concise reports for CIO, EMT, CEO, Board, ARC, programme boards, working groups, NCSC engagements, internal audit and other governance forums as required.

Experience and Qualifications

·Minimum 5 years’ experience in information security, cyber security, IT risk, security operations, IT governance, audit, compliance or a related IT discipline.

·Demonstrable experience managing or coordinating information security activities in a regulated, healthcare, public sector, critical service or operationally sensitive environment.

·Strong knowledge of cyber risk management, control assessments, remediation tracking and governance reporting.

·Experience developing, reviewing, implementing and monitoring cyber security policies, standards, SOPs and procedures.

·Experience preparing cyber security reports for senior management, executive committees, audit/risk committees or Board-level governance forums.

·Practical understanding of NIS2, CyFun, ISO 27001, NIST Cybersecurity Framework.

·Experience coordinating cyber incident response planning, incident exercises, tabletop exercises and post-incident improvement actions.

·Experience supporting internal or external audits, evidence gathering, action tracking and management responses.

·Experience working with third-party technology providers, managed service providers, cyber advisory partners or security vendors.

·Excellent stakeholder management, communication, documentation, meeting facilitation and project coordination skills.

·Ability to work independently, manage multiple priorities, follow up actions to closure and escalate risks where required.

Desirable skills

·Strong technical understanding across IT infrastructure, networks, identity and access management, endpoint security, cloud/SaaS, logging, monitoring, backup, disaster recovery and vulnerability management.

Relevant professional certification such as CISSP, CISM, CRISC, CISA.

Click 'Apply Now ' to submit your resume or send directly to [email protected]