Cybersecurity Risk Manager

We're hiring a Cybersecurity Risk Manager to join a large-scale IT security programme for a major EU agency, delivered through a specialist staffing partner. This is a fully on-site role at the agency's headquarters in Warsaw (100% intra-muros), with no travel foreseen.

The role sits within a highly regulated environment, protecting critical assets and infrastructure, and requires a Personal Security Clearance at CONFIDENTIEL UE/EU CONFIDENTIAL level (screening initiated within the first 45 days of assignment).

Logistics

• Location: Warsaw, Poland - fully on-site, 100% intra-muros, no travel foreseen
• Engagement: framework contract, 12-month initial term with up to 3 annual renewals (up to 48 months total)
• Clearance: Personal Security Clearance required (CONFIDENTIEL UE/EU CONFIDENTIAL), to be initiated within the first 45 days
• Selection process: written test and interview

You'll own the organisation's cybersecurity risk-management lifecycle end to end - from asset inventory and threat/vulnerability assessment through to control design, monitoring, and executive reporting - helping keep risk within acceptable levels across the organisation's assets.

What you'll do

• Develop and maintain the organisation's cybersecurity risk-management strategy
• Manage the asset inventory
• Identify and assess cybersecurity threats and vulnerabilities
• Profile the threat landscape and attacker capability
• Assess risks and propose treatment options (controls, mitigation, avoidance) aligned to strategy
• Monitor control effectiveness and risk levels
• Keep risk within acceptable levels for the organisation's assets
• Develop, maintain, report, and communicate the full risk-management cycle

What you bring

• Strong background in risk assessment, risk-management framework implementation, and stakeholder risk communication
• 9+ years overall IT experience, with 6+ years in a similar risk-management role
• Level 7 education (Master's degree or higher)
• English at C1 level
• At least four of: CISA, CISM, CRISC, CISSP, CGRC, CSSLP, CCSP, CISSP-ISSMP, GSNA, GCCC, GIAC Certified ISO-27000 Specialist, ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, ISO 27005 Risk Manager (or internationally recognised equivalents)
• Experience producing Business Impact Assessments; ServiceNow GRC risk-assessment module experience a plus
• Experience with personal data protection documentation, threat modelling (graphical and programmatic tools, including for DevOps), Zero Trust Architecture design, Secure SDLC, and Directory Services defence controls
• Comfortable presenting risk-informed recommendations to executives and stakeholders, and building an organisation-wide risk-aware culture