Cyber Risk Manager in Eindhoven, Noord-Brabant | Opdracht

Opdrachtomschrijving

General De Eindhoven University of Technology (TU/e) is within scope of the NIS2 directive and has strategically committed to achieving ISO27001 compliance maturity in the coming years. This requires a solid cyber risk management process that is integrated in the overall risk management capability. At this point in time the (cyber) risk management capacity is very limited. The transformation required for NIS2 & ISO27001 requires more capacity & expertise in be ready before July 2028. TU/e consists of various departments, where education and research are conducted, and a number of support services. You will be part of the GRC team within Library and Information Services (LIS) organization. This team will play a prominent role in implementation of cyber risk management, ISO27001 certification & NIS2 readiness. You report to the GRC manager. Brief description of the work • Improved Cyber Risk Assessment Methodology and the TU/e risk management framework: inherent and residual risk. • Completed Risk Assessments and organisational units: impact, and residual risk. Formal identification of risk owners and action owners. • Formal identification of risk owners and action owners. • Business Impact Analyses: Identification of critical activities, supporting systems, data, suppliers, facilities, people, and other dependencies. Safety, and information-security consequences. Recovery Time Objectives and Recovery Point Objectives. • Identification of critical activities, supporting systems, data, suppliers, facilities, people, and other dependencies. • Safety, and information-security consequences. • Recovery Time Objectives and Recovery Point Objectives. • Risk Register and Treatment Plans: Documented risk treatment plans, including actions, priorities, responsible owners, deadlines, and target risk levels. Monitoring of overdue actions, unresolved risks, and risks exceeding the approved risk appetite. • Documented risk treatment plans, including actions, priorities, responsible owners, deadlines, and target risk levels. • Monitoring of overdue actions, unresolved risks, and risks exceeding the approved risk appetite. • Management Reporting and Dashboards: Dashboards showing risk levels, trends, critical risks, treatment progress, overdue actions, and risk acceptance decisions. Reporting that supports ISO 27001 management reviews and NIS2 governance responsibilities. • Dashboards showing risk levels, trends, critical risks, treatment progress, overdue actions, and risk acceptance decisions. • Reporting that supports ISO 27001 management reviews and NIS2 governance responsibilities. • Integration into the Risk PDCA Cycle: Review, and improvement. Consideration of new threats, projects, or supplier changes. Recommendations for improving the maturity and consistency of risk management across TU/e. • Review, and improvement. • Consideration of new threats, projects, or supplier changes. • Recommendations for improving the maturity and consistency of risk management across TU/e. • Business Continuity and Resilience Requirements: Prioritised recommendations for business continuity, disaster recovery, crisis management, backup, redundancy, and cyber resilience. Input for continuity plans, disaster-recovery plans, crisis exercises, and resilience testing. • Prioritised recommendations for business continuity, disaster recovery, crisis management, backup, redundancy, and cyber resilience. • Input for continuity plans, disaster-recovery plans, crisis exercises, and resilience testing. • Compliance and Audit Evidence: Audit-ready documentation supporting internal audits, external certification, regulatory supervision, and management accountability. Evidence monitored, and reviewed. • Audit-ready documentation supporting internal audits, external certification, regulatory supervision, and management accountability. • Evidence monitored, and reviewed. • Knowledge Transfer and Stakeholder Enablement: Enablement of service owners, researchers, and technical teams. Transfer of knowledge to the internal Risk Manager and GRC team. • Enablement of service owners, researchers, and technical teams. • Transfer of knowledge to the internal Risk Manager and GRC team. Key End Products • An approved cyber-risk assessment methodology. • A prioritised portfolio of completed risk assessments and BIAs. • Approved risk treatment and risk acceptance records. • A documented risk PDCA process. • An improvement roadmap for remaining ISO 27001 and NIS2 risk-management gaps. Core Competencies for a Cyber Risk Manager For the Cyber Risk Manager role at TU/e, the following competencies are particularly important. They align with the requested role, which focuses on the risk management PDCA cycle, stakeholder collaboration, risk treatment, reporting, and translating technical risks into impacts on research, education, and business operations. • Cyber Risk Assessment Experience assessing likelihood, impact, inherent risk, and residual risk using a consistent methodology and establishing clear ownership. • Experience assessing likelihood, impact, inherent risk, and residual risk using a consistent methodology and establishing clear ownership. • Business Impact Analysis Experience assessing the operational, financial, legal, reputational, safety, and information-security impact of disruption. Experience defining Recovery Time Objectives and Recovery Point Objectives and related requirements. • Experience assessing the operational, financial, legal, reputational, safety, and information-security impact of disruption. • Experience defining Recovery Time Objectives and Recovery Point Objectives and related requirements. • Knowledge of ISO 27001 and NIS2 Understanding of NIS2 requirements relating to risk management, incident handling, business continuity, supply-chain security, governance, and management accountability. Experience supporting auditability, evidence collection, risk reporting, and continuous improvement. • Understanding of NIS2 requirements relating to risk management, incident handling, business continuity, supply-chain security, governance, and management accountability. • Experience supporting auditability, evidence collection, risk reporting, and continuous improvement. • Analytical and Structured Working Strong analytical skills and attention to the quality and consistency of risk and BIA data. Experience with risk registers, dashboards, reporting, and GRC tooling. • Strong analytical skills and attention to the quality and consistency of risk and BIA data. • Experience with risk registers, dashboards, reporting, and GRC tooling. • Stakeholder Management and Facilitation Ability to engage effectively with service owners, researchers, architects, engineers, project managers, and management. Strong communication skills and the ability to explain cyber risks in clear business language. • Ability to engage effectively with service owners, researchers, architects, engineers, project managers, and management. • Strong communication skills and the ability to explain cyber risks in clear business language. • Pragmatic Implementation Focus on proportionality, avoiding unnecessary complexity and administrative burden, while ensuring effective risk management. • Focus on proportionality, avoiding unnecessary complexity and administrative burden, while ensuring effective risk management. • TU/e-Specific Organisational Awareness Understanding of the specific needs of scientific research, education, laboratories, research infrastructure, and operational technology. Ability to balance security, compliance, resilience, usability, and research objectives. • Understanding of the specific needs of scientific research, education, laboratories, research infrastructure, and operational technology. • Ability to balance security, compliance, resilience, usability, and research objectives. Let op: • 1. Gezien de aard van onderhavige opdracht is het niet mogelijk om hiervoor als zzp’er zelfstandig in te schrijven. Indien een Opdrachtnemer ervoor kiest om een ZZP’er bij de TU/e te plaatsen, omdat dit in zijn of haar optiek mogelijk is, komen alle verplichtingen, ook die krachtens de belasting-, zorgverzekerings- en socialeverzekeringswetgeving met betrekking tot Personeel van Opdrachtnemer, ten laste van Opdrachtnemer. Opdrachtnemer vrijwaart Opdrachtgever tegen elke aansprakelijkheid die daarmee verband houdt waaronder mede begrepen aanspraken van het Personeel van Opdrachtnemer gebaseerd op het beweerdelijk bestaan van een arbeidsovereenkomst met Opdrachtgever, alsmede aanspraken van derden (zoals de Belastingdienst) in dit verband. Zie ook artikel 13 van de Overeenkomst. • 2. De Inschrijver dient – door middel van het overleggen van een uittreksel uit het Handelsregister – aan te tonen dat hij personeel uit mag lenen en voldoet aan de voorwaarden vanuit de Wet Allocatie Arbeidskrachten door Intermediairs (Waadi).