Cyber Risk Assessment Service Manager

Do you thrive on building secure and resilient information systems? Do you have a strong interest in cybersecurity and want to develop your career in this domain?

ST is seeking a talented and motivated Cybersecurity Risk Assessment Expert to join our Central Information Security department within the newly created Corporate Security Organization (CSO). You will play a key role in safeguarding the digital and industrial solutions of the company.

With the support of a pool of external consultants, the candidate will perform 360 degree security risk assessments of IT solutions, and support the teams concerned in addressing the gaps detected, ensuring that risks are understood and managed.

Main responsibilities:

• Manage the risk assessment part of the service "Security Assurance as a Service". Ensure the deliverables are delivered on time and of the expected quality.
• Perform business impact assessments to determine the security/availability rating of IT solutions.
• Participate in the genesis and maintenance of the yearly security assessments plan.
• Conduct thorough risk assessments of IT solutions, covering all aspects, such as:
• Identification of specific cybersecurity requirements.
• Accounts management and authentication.
• Access rights management and data protection.
• Logging and audit features.
• Adherence to the security framework (architecture, software development, contractual and regulatory aspects).
• Keep the central risk database up to date with the results of such risk assessment, ensuring that risks are documented and understood.
• Work closely with stakeholders to close the security gaps detected.
• Using the knowledge acquired from the above activities:
• Participate in the update of the company cybersecurity risk register and cybersecurity company program.
• Propose improvements in the security risk assessments methodology and tooling.
• Propose improvements in the company information security framework and monitoring activities.

Skills:

• 5+ years experience in cybersecurity.
• Sound knowledge of cybersecurity risk assessments / management.
• Sound knowledge of security standards (such as ISO 2700x, NIST) and regulations.
• Master in cybersecurity, IT or equivalent experience.
• Fluency in English within a professional context (written and spoken).
• Cybersecurity certifications (CISSP, CISM, CRISC, SANS) is a plus.

Soft Skills:

• Ability to manage a team of external consultants.
• Very good problem-solving, analytical, and communication skills.
• Ability to translate technical aspects into risks and to communicate on those risks.
• Strong integrity, rigor and proactivity are a must.
• Autonomous.

Skills

CRISC, Cyber Security, ISO 27001, ISO 2700X, NIST, Risk