Cybersecurity Risk Analyst

About the Company: The System Engineer will operationalize the procedure for Risk Assessment of IT Systems in compliance with relevant regulations, i.e. DORA and company policies.

Responsibilities:

• Preparation and Planning:
• Familiarize with DORA regulation (EU 2022/2554) and internal ISM/ISPL policies.
• Define clear system categorization and assessment plans, incorporating confidentiality, integrity, availability, and privacy (CIAP) considerations.
• Establish appropriate organizational contacts and stakeholders.

• Implementation of Assessment Procedures:
• Execute the risk assessment lifecycle on IT systems:
• Identification of threats and vulnerabilities.
• Evaluation and prioritization of risks (including operational disruptions and compliance risks).
• Recommendation and planning of mitigation strategies.

• Documentation and Reporting:
• Update the risk register and document security categorizations.
• Generate and deliver initial and final assessment reports.
• Create or update documentation of all security, privacy, and operational assessments.
• Update Confluence pages and other organizational repositories as required.

• Interfaces and Collaboration:
• Report directly to the Head of IT Security.
• Collaborate closely with IT Operations, stakeholders, and leadership teams.
• Engage in periodic and ad-hoc reviews, maintaining alignment with evolving regulations and company strategies.

Deliverables:

• Detailed risk assessment reports and updated risk registers.
• Security and privacy plans, including documented controls and mitigation strategies.
• Updated system configuration management documentation.
• Evidence of successful integration into organizational incident response and contingency frameworks.
• Regular updates in organizational knowledge bases (Confluence).
• Updated work instructions and risk assessment guidelines.