Lead Cybersecurity Risk Management Consultant

at  Epam Systems

REQUIREMENTS

• 5+ years of relevant IT and Information Security experience
• 1+ year of relevant leadership experience
• Proven expertise in risk management, with a strong focus on the FAIR methodology
• Advanced knowledge of industry authoritative sources such as NIST, COBIT, GDPR, and ISO standards
• Strong quantitative analytical skills to evaluate risk scenarios and outcomes
• In-depth knowledge of the full risk management process, including identification, assessment, mitigation, monitoring, and reporting
• Ability to work collaboratively with cross-functional teams to integrate risk management practices into overall business strategies
• Should possess or be working towards one or more of CISSP, CISM, CISA or other relevant security certification
• Stakeholder management, communication and presentation skills
• Familiarity with GRC platforms, security-related legal and regulatory requirements
• Excellent command of English language, both written and spoken at a B2+ level

• Support the Head of Cyber Security departments in the development of Information Security strategic plans and defining the tactical initiatives necessary to achieve strategic goals related to information security in the respective countries
• Apply and support the Factor Analysis of Information Risk (FAIR) methodology to quantitatively analyze and manage information risk
• Develop and implement comprehensive risk management strategies and processes across the organization
• Conduct thorough risk assessments and analysis to identify potential threats and vulnerabilities
• Monitor and report on risk management activities, providing actionable insights to stakeholders
• Ensure that all external information security requirements for the external legal and regulatory mandates are embedded in the IS control framework
• Design a strong understanding of potential IS risks and support in keeping updated the relative threat landscape
• Monitor and report on compliance with industry standards and regulations
• Record cyber risk activities and issues in GRC tool, follow up on issues and report assessment results and risk ratings to the appropriate level(s)
• Periodically review the risk process for continuous improvements in the process to ensure the most effective and efficient process is implemented
• Analyze business requirements and determine overall IS training strategy
• Maintain the IS policy framework (policies, standards), ensuring ongoing accuracy and applicability
• Identify new business requirements or industry trends, analyze business impact, and make policy framework adjustments when necessary