Cyber Risk Manager

Dit ben jij

• A documented and practical risk assessment methodology aligned with ISO
  27001, ISO 27005, NIS2, and the TU/e risk management framework
• Standard templates, scoring criteria, risk categories, impact scales, and
  guidance for assessing inherent and residual risk
• Clear criteria for risk acceptance, escalation, treatment, and management
  approval
• Risk assessments for agreed critical services, systems, projects,
  suppliers, research environments, and organisational units
• Clear documentation of assets, threats, vulnerabilities, existing
  controls, risk scenarios, likelihood, impact, and residual risk
• Prioritised findings and recommendations that can be translated into
  concrete improvement actions
• Formal identification of risk owners and action owners
• Completed BIAs for critical education, research, operational, and
  supporting processes
• Identification of critical activities, supporting systems, data,
  suppliers, facilities, people, and other dependencies
• Documented impact assessments covering operational, financial, legal,
  regulatory, reputational, safety, and information-security consequences
• Defined Maximum Tolerable Periods of Disruption, recovery priorities,
  Recovery Time Objectives, and Recovery Point Objectives
• An up-to-date and structured cyber and IT risk register
• Documented risk treatment plans, including actions, priorities,
  responsible owners, deadlines, and target risk levels
• Formal records of accepted, transferred, avoided, or mitigated risks
• Monitoring of overdue actions, unresolved risks, and risks exceeding the
  approved risk appetite
• Periodic management reports on the overall cyber-risk exposure of LIS and
  TU/e
• Dashboards showing risk levels, trends, critical risks, treatment
  progress, overdue actions, and risk acceptance decisions
• Clear escalation reports for risks requiring management or executive
  decision-making
• Reporting that supports ISO 27001 management reviews and NIS2 governance
  responsibilities
• A functioning risk management cycle covering identification, assessment,
  treatment, monitoring, review, and improvement
• Defined review frequencies and triggers for reassessment, such as major
  changes, incidents, new threats, projects, or supplier changes
• Evidence that risk assessments and BIAs are periodically reviewed and
  kept current
• Recommendations for improving the maturity and consistency of risk
  management across TU/e
• Recovery and continuity requirements based on BIA outcomes
• Prioritised recommendations for business continuity, disaster recovery,
  crisis management, backup, redundancy, and cyber resilience
• Identification of gaps between required and actual recovery capabilities
• Input for continuity plans, disaster-recovery plans, crisis exercises,
  and resilience testing
• Documented evidence demonstrating that cyber risks are systematically
  identified, assessed, treated, monitored, and reviewed
• Traceability between risks, ISO 27001 controls, NIS2 obligations,
  policies, and improvement actions
• Audit-ready documentation supporting internal audits, external
  certification, regulatory supervision, and management accountability
• Support for the preparation and follow-up of ISO 27001 and NIS2
  assessments
• Workshops, guidance, and practical training for service owners, risk
  owners, project managers, researchers, and technical teams
• Clear instructions explaining roles, responsibilities, assessment
  methods, and expected evidence
• Transfer of knowledge to the internal Risk Manager and GRC team
• Increased stakeholder capability to independently identify, assess, and
  manage cyber risks
• At minimum, the assignment should result in
• An approved cyber-risk assessment methodology
• Standard risk assessment and BIA templates
• A prioritised portfolio of completed risk assessments and BIAs
• An updated risk register with assigned ownership
• Approved risk treatment and risk acceptance records
• A management dashboard and periodic reporting cycle
• A documented risk PDCA process
• Integration of risk management into relevant project and change
  processes
• An improvement roadmap for remaining ISO 27001 and NIS2 risk-management
  gaps
• Ability to identify assets, threats, vulnerabilities, dependencies, and
  existing controls
• Experience assessing likelihood, impact, inherent risk, and residual risk
  using a consistent methodology
• Ability to translate identified risks into practical mitigation measures,
  formal risk acceptance, and clear ownership
• Understanding of risk appetite, risk tolerance, and escalation criteria
• Ability to identify critical education, research, IT, and business
  processes
• Experience assessing the operational, financial, legal, reputational,
  safety, and information-security impact of disruption
• Ability to determine maximum tolerable downtime, recovery priorities,
  critical dependencies, Recovery Time Objectives and Recovery Point
  Objectives
• Ability to translate BIA outcomes into business continuity, disaster
  recovery, and resilience requirements
• Strong working knowledge of ISO 27001, ISO 27005, and
  information-security risk management
• Understanding of NIS2 requirements relating to risk management, incident
  handling, business continuity, supply-chain security, governance, and
  management accountability
• Ability to link identified risks to applicable ISO 27001 controls and
  NIS2 obligations
• Experience supporting auditability, evidence collection, risk reporting,
  and continuous improvement
• Ability to bring structure to complex and decentralised IT environments
• Strong analytical skills and attention to the quality and consistency of
  risk and BIA data
• Ability to identify cross-organisational dependencies, concentration
  risks, and systemic risks
• Experience with risk registers, dashboards, reporting, and GRC tooling
• Strong workshop and interview skills for facilitating risk assessments
  and BIAs
• Ability to engage effectively with service owners, researchers,
  architects, engineers, project managers, and management
• Ability to challenge stakeholders constructively while maintaining trust
  and cooperation
• Strong communication skills and the ability to explain cyber risks in
  clear business language
• Ability to translate frameworks and regulatory requirements into workable
  processes
• Focus on proportionality, avoiding unnecessary complexity and
  administrative burden
• Ability to embed risk management into projects, changes, procurement,
  architecture, and service management
• Strong ownership and follow-up skills to ensure that risk treatment
  actions are completed
• Ability to work in a highly autonomous and decentralised university
  environment
• Understanding of the specific needs of scientific research, education,
  laboratories, research infrastructure, and operational technology
• Sensitivity to academic freedom, innovation, data sovereignty, and the
  need for flexible IT solutions
• Ability to balance security, compliance, resilience, usability, and
  research objectives