Cyber Risk Analyst – AI

Job Location: hybrid in Bucharest

Recruitment process:

• HR screening
  
• Technical Interview
• Cultural discusion

Role description:

The Cyber Risk Analyst is also a subject matter expert leveraging a deep understanding of the enterprise risk discipline and regulatory compliance combining deep knowledge of theory and organizational practice or expertise across several different disciplines within a function.

Job Responsibilities:

• Build and apply knowledge of cybersecurity and IT controls, systems and process landscape to enable clear understanding of impact and lead Initiative affecting wider organizations.
• Perform comprehensive risk assessments for AI/ML and GenAI projects to identify potential security vulnerabilities and threats.
• Work closely with data scientists and AI/ML engineers to understand the data flows, algorithms, and models, ensuring security measures are integrated throughout the development lifecycle.
• Assess the security of third-party AI/ML tools and platforms, ensuring they meet organizational security standards and compliance requirements.
• Maintain detailed documentation of risk assessments, security measures, and incident reports, and provide regular updates to senior management and relevant stakeholders.
• Keep abreast of the latest cybersecurity threats, trends, and technologies related to AI/ML and GenAI, and proactively update security strategies accordingly.
• Support stakeholders with cybersecurity or regulatory compliance related risk expertise and knowledge. Responsible for identifying technology risks and proposing control design.
• Provide advice on control & indicators design that is both sustainable and right sized (i.e. a simple solution for a simple problem, no overengineering).
• Support with operational activities related to cybersecurity risk management. Includes supporting cyber risk assessments, security policy exceptions, and assessing issues from a cyber risk perspective.
• Liaise with other risk and audit teams (Risk and Controls, Internal Audit, external auditors, Business continuity teams, IT Disaster recovery and Service continuity team etc.) as needed and provide support with audits.
• Reporting on control execution, coverage, KPI and issues through booking reporting and dashboarding tools (Jira, Tableau, ServiceNow).
• Stay flexible to meet the dynamic business needs, while maintaining robust solutions that strengthen the control environment.
• Be flexible and agile in response to the change in business, change in stakeholder expectations and/or change in regulatory/operating environment of B.com.
• Be able to split large tasks into logical, manageable and decoupled actions which are managed effectively and delivered on time.

Experience:

• Preferred: 5+ years of experience gained within IT risk, compliance, internal controls or audit within a highly regulated industry.
• Minimum: 3 years of experience gained within IT risk, compliance, internal controls or audit within a highly regulated industry.

Technical skills:

• Strong knowledge and work experience with IT General Controls and best practice cybersecurity controls.
• Thorough technical understanding of internal control requirements and design and experience in applying them in various businesses.
• Knowledge of relevant regulations and standards such as: SOX, DMA/DSA, EU AI Act, GDPR, NIST, PCI, and CCPA.
• Solid understanding of cybersecurity risks and data protection.
• Good technical knowledge of enterprise technology infrastructure, including cloud platforms, big data technologies, AI systems, etc.
• Awareness of the latest cybersecurity threats, trends, and emerging technologies related to AI/ML and GenAI.

Soft skills:

• Strong communication and collaboration skills, with the ability to develop solid relationships with business partners to drive the adoption of the risk management culture.
• Strong stakeholder management skills, with the ability to influence others who may be skeptical or resistant to new concepts, practices, and approaches.
• Ability to quickly adapt to changes, new requirements, or sudden shifts in direction.
• Strong analytical and problem-solving skills.
• Ability to independently take initiative, identify new projects and deliver with minimal support from the team or manager.

Desired qualifications (Nice to have, but not mandatory):

• Experience working on AI/ML and GenAI projects, particularly in security or risk assessment capacity.
• Knowledge of industry standards and regulatory requirements relevant to AI/ML and GenAI initiatives.
• Knowledge of AI/ML and GenAI technologies, Large Language Models (LLMs), algorithms, and data processing techniques, including their development and deployment processes.
• Hands-on experience with large e-commerce or tech companies.
• Working experience in a DevOps environment. Knowledge of DevOps tools such as Puppet, Git, Docker or Kubernetes, or any IT Service Management tools.
• Business or IT certificates (CISA, CISM).

Work conditions:

Working hours: 9:00-18:00 Working setup (hybrid, on site, remote): hybrid way of working with an onsite presence of 2 days/week.