Cyber Risk & GRC Analyst

About the role

New. Cold's cyber risk function is scaling fast: risk assessments, supplier due diligence, and (ISO 27001 and NIS2-driven governance work have grown to a volume that needs a dedicated person to provide the right level of focus. This role exists to keep that pipeline moving: triaging intake, running the risk register day-to-day, chasing evidence collection, and turning raw risk data into reporting that leadership can act on.

It's a hands-on, high-throughput role rather than a strategic or policy-setting one. We're looking for someone who's actually run a risk register under time pressure, not just someone who can talk fluently about frameworks. Must-have experience: 3–5 years in cyber security risk management, IT risk, or GRC, in a regulated or complex enterprise environment.

Hands-on risk register ownership: risk articulation, scoring, treatment tracking, and producing executive-ready reporting. Supplier/third-party risk assessment execution: questionnaire-based due diligence, evidence review, and posture evaluation, done independently and at volume. High-volume triage: proven ability to prioritize a busy intake queue based on risk and business impact, without things slipping.

Working knowledge and experience with frameworks such as: ISO/IEC 27001/27002, NIST CSF, or CIS Controls with the ability to map control evidence to risk outcomes. Communication cross-cultural stakeholder skills: strong written and verbal communication skills, with the ability to adapt tone and approach across internal and external stakeholders, from technical engineers to senior business leaders to third-party suppliers.

Comfortable operating across cultures and communication styles given New. Cold's multinational footprint, and able to build trust and drive follow-through with stakeholders from different regional and organisational backgrounds. Stakeholder follow-through: comfortable chasing technical teams, procurement, IT, and business stakeholders repeatedly until items close out.

Preferred / nice-to-have: Exposure to supplier tiering, criticality assessment, or ongoing supplier monitoring models. Familiarity with OT/industrial risk concepts (e.g. IEC 62443, Purdue model) would be a plus given New. Cold's OT environment. Certified in Risk and Information Systems Control (CRISC). Experience with GRC or workflow tooling (e.

g. Archer, Service. Now GRC, Jira, Monday.com or equivalent). Prior experience operating across multiple regions/time zones. Understanding of risk governance concepts: risk appetite, residual risk, risk acceptance, escalation paths. How success looks like in the first 6 months: Risk register is current, accurately scored, and reporting cadence is reliable without prompting.

Supplier risk assessment backlog is under control, with clear tiering and a repeatable evidence-review process. Stakeholders across regions know who to go to and trust the follow-up will happen.