Cybersecurity Risk Manager
The opportunity
We're hiring a Cybersecurity Risk Manager to join a large-scale IT security programme for a major EU agency, delivered through a specialist staffing partner. This is a fully on-site role at the agency's headquarters in Warsaw (100% intra-muros), with no travel foreseen.
The role sits within a highly regulated environment, protecting critical assets and infrastructure, and requires a Personal Security Clearance at CONFIDENTIEL UE/EU CONFIDENTIAL level (screening initiated within the first 45 days of assignment).
The role
You'll own the organisation's cybersecurity risk-management lifecycle end to end - from asset inventory and threat/vulnerability assessment through to control design, monitoring, and executive reporting - helping keep risk within acceptable levels across the organisation's assets.
What you'll do
Develop and maintain the organisation's cybersecurity risk-management strategy
Manage the asset inventory
Identify and assess cybersecurity threats and vulnerabilities
Profile the threat landscape and attacker capability
Assess risks and propose treatment options (controls, mitigation, avoidance) aligned to strategy
Monitor control effectiveness and risk levels
Keep risk within acceptable levels for the organisation's assets
Develop, maintain, report, and communicate the full risk-management cycle
What you bring
Strong background in risk assessment, risk-management framework implementation, and stakeholder risk communication
9+ years overall IT experience, with 6+ years in a similar risk-management role
Level 7 education (Master's degree or higher)
English at C1 level
At least four of: CISA, CISM, CRISC, CISSP, CGRC, CSSLP, CCSP, CISSP-ISSMP, GSNA, GCCC, GIAC Certified ISO-27000 Specialist, ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, ISO 27005 Risk Manager (or internationally recognised equivalents)
Experience producing Business Impact Assessments; ServiceNow GRC risk-assessment module experience a plus
Experience with personal data protection documentation, threat modelling (graphical and programmatic tools, including for DevOps), Zero Trust Architecture design, Secure SDLC, and Directory Services defence controls
Comfortable presenting risk-informed recommendations to executives and stakeholders, and building an organisation-wide risk-aware culture
Logistics
Location: Warsaw, Poland - fully on-site, 100% intra-muros, no travel foreseen
Engagement: framework contract, 12-month initial term with up to 3 annual renewals (up to 48 months total)
Clearance: Personal Security Clearance required (CONFIDENTIEL UE/EU CONFIDENTIAL), to be initiated within the first 45 days
Selection process: written test and interview