Security Assessor

TPRM Security Assessor

Location: Poland (preferably Warsaw)

Start: ASAP

Hybrid: 6 days in Warsaw per month.

Remuneration: 155- 175 PLN/h
Contract Duration: Until 31 December 2026
Department: Global Security – Information Security Governance / Third-Party Risk Management (TPRM)
Reporting to: Manager, Information Security Governance

About the Role

We are seeking an experienced Security Assessor to support Third-Party Risk Management (TPRM) operations through the end of 2026. The consultant will play a key role in executing supplier security assessments, supporting reassessment activities, engaging with internal stakeholders and suppliers, and helping the team address ongoing operational and audit-related priorities.

This role is ideal for a cybersecurity or risk management professional who enjoys working in a fast-paced environment and has experience evaluating third-party security controls and managing supplier risk.

Key Responsibilities

Supplier Security Assessments

• Conduct information security assessments of new and existing suppliers.

• Review supplier responses, security documentation, certifications, audit reports, and evidence.

• Evaluate supplier security posture and identify potential risks and control gaps.

• Provide risk-based recommendations to business stakeholders and project teams.

• Support assessment prioritization based on supplier criticality and risk exposure.

Reassessments and Ongoing Monitoring

• Execute periodic reassessments of suppliers according to established risk-based cycles.

• Follow up with suppliers regarding overdue assessments and remediation activities.

• Support tracking of reassessment deadlines and escalation processes.

• Contribute to continuous monitoring activities and review of security posture changes.

Stakeholder and Supplier Engagement

• Serve as a security point of contact for internal business stakeholders and suppliers.

• Clearly communicate security requirements and assessment outcomes.

• Facilitate meetings and discussions related to supplier security concerns.

• Support resolution of assessment findings and clarification requests.

Process and Documentation Support

• Maintain accurate records of assessments, findings, and decisions within TPRM tools.

• Support the quality and consistency of assessment documentation.

• Identify opportunities to improve assessment processes, templates, and workflows.

• Assist with audit evidence collection and reporting activities when required.

Requiements:

• 2+ years of experience in:

  • Third-Party Risk Management (TPRM)

  • Information Security

  • Cybersecurity Risk Management

  • IT Audit or Governance, Risk, and Compliance (GRC)

• Experience performing vendor or supplier security assessments.

• Strong understanding of information security principles and common control domains, including:

  • Access Management

  • Vulnerability Management

  • Incident Response

  • Business Continuity

  • Security Monitoring

  • Data Protection

• Experience reviewing security questionnaires and industry-standard assurance reports (e.g., SOC 2, ISO 27001, CAIQ, SIG).

• Excellent written and verbal communication skills in English.

Nice to have:

• Relevant certifications such as:

  • CRISC

  • CISA

  • CISSP

  • ISO 27001 Lead Auditor

  • CTPRP

• Experience with security governance, supplier risk management, or GRC platforms.

• Experience working in an international and cross-functional environment.

• Knowledge of privacy and data protection requirements related to third-party services.

Personal Competencies

• Strong analytical and risk-based decision-making skills.

• Attention to detail and ability to manage multiple assessments simultaneously.

• Ability to work independently with minimal supervision.

• Strong stakeholder management and collaboration skills.

• Continuous improvement mindset and focus on operational excellence.

What Success Looks Like

By the end of the engagement, the consultant will have:

• Supported delivery of supplier security assessments and reassessments in line with agreed priorities.

• Helped reduce assessment backlogs and improve reassessment governance.

• Contributed to audit readiness and evidence collection activities.

• Ensured high-quality, risk-based assessment outcomes and stakeholder support.