Cyber Risk Manager

Als Cyber Risk Manager ben je verantwoordelijk voor het opzetten, verbeteren en uitvoeren van een geïntegreerd cyberrisicomanagementproces. Je richt je op risicoanalyse, business impact analyses, risicobehandeling, rapportage en audit-bewijsvoering, met aandacht voor business continuity en veerkracht.

Belangrijkste taken en verantwoordelijkheden

- Risicometodologie: Ontwikkelen en verbeteren van een consistente cyber risk assessment-methodiek en koppeling aan het bredere risicomanagementkader (inclusief inherent en residueel risico).

- Risicobeoordelingen: Uitvoeren en afronden van risicoassessments voor organisatorische eenheden, inclusief formaliseren van risico- en actie-eigenaarschap.

- Business Impact Analyses (BIA): Identificeren van kritische activiteiten en afhankelijkheden (systemen, data, leveranciers, faciliteiten, mensen) en bepalen van impact, RTO en RPO.

- Risicoregister en behandelplannen: Vastleggen van risico’s met behandelplannen, acties, prioriteiten, eigenaren en targetrisiconiveaus; monitoren van openstaande acties en risico’s buiten de appetijt.

- Managementrapportage en dashboards: Opzetten van dashboards en rapportages die risico-niveaus, trends, kritische risico’s, voortgang en acceptatiebesluiten zichtbaar maken, en die managementreviews en governance ondersteunen.

- Integratie in PDCA: Integreren van risicomanagement in een PDCA-cycle voor risico’s, inclusief review en verbeteracties bij veranderingen (dreigingen, projecten, leveranciers).

- Business continuity & resilience: Prioriteren van aanbevelingen voor continuïteit, disaster recovery, crisismanagement, back-up en redundantie; input leveren voor continuïteits- en herstelscenario’s en oefeningen.

- Compliance en audit: Zorgdragen voor audit-ready documentatie ter ondersteuning van interne audits, externe certificering en toezichthoudende eisen.

- Kennisoverdracht: Enablement van stakeholders, trainen van medewerkers en overdracht van kennis aan interne risicomanagementcollega’s.

Belangrijke eindproducten

- Goedgekeurde cyberrisico-assessmentmethodologie

- Geprioriteerde portfolio van afgeronde risico-assessments en BIA’s

- Goedgekeurde risicobehandelings- en risicoacceptatieregistraties

- Gedocumenteerd risico-PDCA-proces

- Verbeterroadmap voor resterende risico-managementgaps (ISO27001/NIS2-gerelateerd)

Gevraagde competenties en kennis

- Cyber Risk Assessment: Ervaring met beoordelen van kans, impact, inherent en residueel risico volgens een consistente methodiek en met duidelijke eigenaarschap.

- Business Impact Analysis: Ervaring met beoordelen van operationele, financiële, juridische, reputatie-, veiligheids- en informatiebeveiligingsimpact; kennis van RTO en RPO.

- Kennis van ISO27001 en NIS2: Inzicht in risicomanagement, incidentafhandeling, continuïteit, leveranciersbeveiliging en bestuurlijke verantwoording; ervaring met bewijsvoering en auditabiliteit.

- Analytisch en gestructureerd werken: Sterke analytische vaardigheden en aandacht voor kwaliteit en consistentie van risico- en BIA-data; ervaring met risicoregisters, dashboards en GRC-tooling.

- Stakeholdermanagement en faciliteren: Vaardigheid om effectief samen te werken met service-eigenaren, onderzoekers, architecten, engineers en management; heldere communicatiestijl in businesstaal.

- Pragmatische implementatie: Focus op proportionaliteit en vermijding van onnodige complexiteit of administratieve lasten.

- Organisatorische bewustzijn: Inzicht in de specifieke behoeften van onderzoek, onderwijs, laboratoria en operationele technologie; balans tussen security, compliance, resilience en usability.

- Voertaal: Engels (gebruik van de Engelse vakterminologie en communicatie).

Eisen

- A documented and practical risk assessment methodology aligned with ISO

27001, ISO 27005, NIS2, and the TU/e risk management framework

- Standard templates, scoring criteria, risk categories, impact scales, and

guidance for assessing inherent and residual risk

- Clear criteria for risk acceptance, escalation, treatment, and management

approval

- Risk assessments for agreed critical services, systems, projects,

suppliers, research environments, and organisational units

- Clear documentation of assets, threats, vulnerabilities, existing

controls, risk scenarios, likelihood, impact, and residual risk

- Prioritised findings and recommendations that can be translated into

concrete improvement actions

- Formal identification of risk owners and action owners

- Completed BIAs for critical education, research, operational, and

supporting processes

- Identification of critical activities, supporting systems, data,

suppliers, facilities, people, and other dependencies

- Documented impact assessments covering operational, financial, legal,

regulatory, reputational, safety, and information-security consequences

- Defined Maximum Tolerable Periods of Disruption, recovery priorities,

Recovery Time Objectives, and Recovery Point Objectives

- An up-to-date and structured cyber and IT risk register

- Documented risk treatment plans, including actions, priorities,

responsible owners, deadlines, and target risk levels

- Formal records of accepted, transferred, avoided, or mitigated risks

- Monitoring of overdue actions, unresolved risks, and risks exceeding the

approved risk appetite

- Periodic management reports on the overall cyber-risk exposure of LIS and

TU/e

- Dashboards showing risk levels, trends, critical risks, treatment

progress, overdue actions, and risk acceptance decisions

- Clear escalation reports for risks requiring management or executive

decision-making

- Reporting that supports ISO 27001 management reviews and NIS2 governance

responsibilities

- A functioning risk management cycle covering identification, assessment,

treatment, monitoring, review, and improvement

- Defined review frequencies and triggers for reassessment, such as major

changes, incidents, new threats, projects, or supplier changes

- Evidence that risk assessments and BIAs are periodically reviewed and

kept current

- Recommendations for improving the maturity and consistency of risk

management across TU/e

- Recovery and continuity requirements based on BIA outcomes

- Prioritised recommendations for business continuity, disaster recovery,

crisis management, backup, redundancy, and cyber resilience

- Identification of gaps between required and actual recovery capabilities

- Input for continuity plans, disaster-recovery plans, crisis exercises,

and resilience testing

- Documented evidence demonstrating that cyber risks are systematically

identified, assessed, treated, monitored, and reviewed

- Traceability between risks, ISO 27001 controls, NIS2 obligations,

policies, and improvement actions

- Audit-ready documentation supporting internal audits, external

certification, regulatory supervision, and management accountability

- Support for the preparation and follow-up of ISO 27001 and NIS2

assessments

- Workshops, guidance, and practical training for service owners, risk

owners, project managers, researchers, and technical teams

- Clear instructions explaining roles, responsibilities, assessment

methods, and expected evidence

- Transfer of knowledge to the internal Risk Manager and GRC team

- Increased stakeholder capability to independently identify, assess, and

manage cyber risks

- At minimum, the assignment should result in

- An approved cyber-risk assessment methodology

- Standard risk assessment and BIA templates

- A prioritised portfolio of completed risk assessments and BIAs

- An updated risk register with assigned ownership

- Approved risk treatment and risk acceptance records

- A management dashboard and periodic reporting cycle

- A documented risk PDCA process

- Integration of risk management into relevant project and change

processes

- An improvement roadmap for remaining ISO 27001 and NIS2 risk-management

gaps

- Ability to identify assets, threats, vulnerabilities, dependencies, and

existing controls

- Experience assessing likelihood, impact, inherent risk, and residual risk

using a consistent methodology

- Ability to translate identified risks into practical mitigation measures,

formal risk acceptance, and clear ownership

- Understanding of risk appetite, risk tolerance, and escalation criteria

- Ability to identify critical education, research, IT, and business

processes

- Experience assessing the operational, financial, legal, reputational,

safety, and information-security impact of disruption

- Ability to determine maximum tolerable downtime, recovery priorities,

critical dependencies, Recovery Time Objectives and Recovery Point

Objectives

- Ability to translate BIA outcomes into business continuity, disaster

recovery, and resilience requirements

- Strong working knowledge of ISO 27001, ISO 27005, and

information-security risk management

- Understanding of NIS2 requirements relating to risk management, incident

handling, business continuity, supply-chain security, governance, and

management accountability

- Ability to link identified risks to applicable ISO 27001 controls and

NIS2 obligations

- Experience supporting auditability, evidence collection, risk reporting,

and continuous improvement

- Ability to bring structure to complex and decentralised IT environments

- Strong analytical skills and attention to the quality and consistency of

risk and BIA data

- Ability to identify cross-organisational dependencies, concentration

risks, and systemic risks

- Experience with risk registers, dashboards, reporting, and GRC tooling

- Strong workshop and interview skills for facilitating risk assessments

and BIAs

- Ability to engage effectively with service owners, researchers,

architects, engineers, project managers, and management

- Ability to challenge stakeholders constructively while maintaining trust

and cooperation

- Strong communication skills and the ability to explain cyber risks in

clear business language

- Ability to translate frameworks and regulatory requirements into workable

processes

- Focus on proportionality, avoiding unnecessary complexity and

administrative burden

- Ability to embed risk management into projects, changes, procurement,

architecture, and service management

- Strong ownership and follow-up skills to ensure that risk treatment

actions are completed

- Ability to work in a highly autonomous and decentralised university

environment

- Understanding of the specific needs of scientific research, education,

laboratories, research infrastructure, and operational technology

- Sensitivity to academic freedom, innovation, data sovereignty, and the

need for flexible IT solutions

- Ability to balance security, compliance, resilience, usability, and

research objectives

Vul je gegevens hieronder in, dan nemen we binnen 2 uur contact met je op om samen te kijken of er een match is. Heb je nog vragen? Bel ons op [telefoonnummer] of stuur een e-mail naar [e-mailadres] We helpen je graag verder!