Cybersecurity Risk Manager

We're hiring a Cybersecurity Risk Manager to join a large-scale IT security programme for a major EU agency, delivered through a specialist staffing partner. This is a fully on-site role at the agency's headquarters in Warsaw (100% intra-muros), with no travel foreseen.

The role sits within a highly regulated environment, protecting critical assets and infrastructure, and requires a Personal Security Clearance at CONFIDENTIEL UE/EU CONFIDENTIAL level (screening initiated within the first 45 days of assignment).

Logistics

Location: Warsaw, Poland - fully on-site, 100% intra-muros, no travel foreseen

Engagement: framework contract, 12-month initial term with up to 3 annual renewals (up to 48 months total)

Clearance: Personal Security Clearance required (CONFIDENTIEL UE/EU CONFIDENTIAL), to be initiated within the first 45 days

Selection process: written test and interview

You'll own the organisation's cybersecurity risk-management lifecycle end to end - from asset inventory and threat/vulnerability assessment through to control design, monitoring, and executive reporting - helping keep risk within acceptable levels across the organisation's assets.

What you'll do

Develop and maintain the organisation's cybersecurity risk-management strategy

Manage the asset inventory

Identify and assess cybersecurity threats and vulnerabilities

Profile the threat landscape and attacker capability

Assess risks and propose treatment options (controls, mitigation, avoidance) aligned to strategy

Monitor control effectiveness and risk levels

Keep risk within acceptable levels for the organisation's assets

Develop, maintain, report, and communicate the full risk-management cycle

What you bring

Strong background in risk assessment, risk-management framework implementation, and stakeholder risk communication

9+ years overall IT experience, with 6+ years in a similar risk-management role

Level 7 education (Master's degree or higher)

English at C1 level

At least four of: CISA, CISM, CRISC, CISSP, CGRC, CSSLP, CCSP, CISSP-ISSMP, GSNA, GCCC, GIAC Certified ISO-27000 Specialist, ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, ISO 27005 Risk Manager (or internationally recognised equivalents)

Experience producing Business Impact Assessments; ServiceNow GRC risk-assessment module experience a plus

Experience with personal data protection documentation, threat modelling (graphical and programmatic tools, including for DevOps), Zero Trust Architecture design, Secure SDLC, and Directory Services defence controls

Comfortable presenting risk-informed recommendations to executives and stakeholders, and building an organisation-wide risk-aware culture