Vendor Due Diligence Specialist

• Position: Vendor Due Diligence Specialist

• Location: Warsaw, Poland

• Working mode: hybrid

About our client

Our client is a leading global investment firm operating across multiple asset classes and markets. The company combines fundamental and systematic investment strategies with advanced technology to support its global investment operations.

The Technology team focuses on developing and maintaining a modern technology infrastructure, leveraging open-source solutions, cloud technologies, AI and modern engineering practices. The company promotes continuous learning, innovation and collaboration, giving specialists the opportunity to contribute to business-critical initiatives in an international environment.

About the role

As a Vendor Due Diligence Specialist, you will play a key role in the company’s third-party information security risk management program. You will conduct technical security assessments of external vendors, evaluating their security controls, technology environments and potential risks associated with providing services to the firm. Your responsibilities will include reviewing security documentation, analyzing technical architectures and identifying gaps in vendor security practices. You will collaborate with internal teams and external partners to validate findings, assess remediation plans and prepare clear, risk-based reports. The role requires strong technical expertise, independent judgment and the ability to communicate security risks effectively to both technical and non-technical stakeholders.

Requirements

• At least 5 years of experience in information security, technology risk, security engineering, security architecture or third-party risk management.

• Experience conducting technical security assessments of third-party environments, including evaluating security controls and their effectiveness.

• Bachelor’s degree in Information Security, Information Systems, Information Technology or a related field.

• Strong understanding of cloud environments, SaaS solutions, identity and access management, network security, vulnerability management and data protection.

• Knowledge of logging and monitoring, incident response, application security and technical security controls in complex IT environments.

• Familiarity with security frameworks and standards such as NIST CSF, NIST 800-53, ISO 27001 and SOC 2.

• Ability to analyze technical evidence, challenge vendor statements and independently assess security risks.

• Strong analytical and communication skills, including the ability to explain complex security issues to different audiences.

• Ability to work independently, manage multiple assessments simultaneously and collaborate with cross-functional teams.

• High ethical standards and a responsible approach to handling sensitive information.

Responsibilities

• Act as a technical subject matter expert within the third-party information security risk management program.

• Conduct in-depth security assessments of new and existing vendors that access, process, store or transmit company information.

• Evaluate the design and effectiveness of vendor security controls across different technology environments and service models.

• Analyze business requirements, data flows, system integrations and technical architectures to identify potential security risks.

• Review security documentation, including audit reports, certifications, penetration test results, vulnerability assessments, policies and architecture diagrams.

• Assess controls related to identity and access management, cloud and infrastructure security, network security, vulnerability management, data protection, monitoring, incident response and application security.

• Work with vendors and internal technical teams to validate assessment responses, investigate security gaps and review remediation plans.

• Prepare clear, risk-based assessment reports outlining identified issues, their potential impact and recommended actions.

• Collaborate with Technology, Compliance, Legal, Procurement and other teams to maintain a consistent approach to third-party risk management.

• Continuously improve assessment methodologies, processes, templates and metrics while staying up to date with emerging threats and security best practices.

The offer

Benefits and development opportunities:

• Opportunity to work within an international investment firm with a global business presence.

• Collaboration with experienced professionals across technology, information security, compliance and other business functions.

• Exposure to complex technology environments and business-critical information security challenges.

• Opportunities to develop technical expertise and contribute to improving security risk management practices.

• A work environment that encourages innovation, continuous learning and professional growth.

Additional benefits mentioned in the company’s general description:

• Sports card.

• Private life insurance.

• Private medical and dental care, including a vision allowance.

• Private pension scheme.

• Business travel accident insurance.

• Employee Assistance Program.

• Educational assistance and reimbursement.

• Volunteer opportunities.

• Contract of employment.

• Budget up to 27 000 PLN gross/month.