Cyber Risk Analyst - Lisbon/Hybrid

• Bachelor's or Master's degree (preferred) in Management, Cybersecurity, Informatics, Information Systems, or an equivalent field;
• Relevant professional experience (implementation and/or execution of Cybersecurity Risk Management, Information Security, or GRC) of at least 2 years;
• Knowledge of Risk Management methodologies;
• Knowledge of relevant standards in the field of Cybersecurity and Information Security (e.g., ISO 27001, ISO 27005, NIST CSF);
• Knowledge of Information Technologies (e.g., information systems management, application platforms, software development);
• Experience and/or knowledge of GRC tools and risk registers;
• Basic knowledge of Governance, Risk & Compliance frameworks;

• Experience in Disaster Recovery and/or Business Continuity projects.
• Experience/Certifications/Training in NIS2 and ISO 27001 projects.
• Experience in Risk Management.
• Participation in compliance assessments.
• Additional training in Risk Management or Information Security.
• Interest in aeronautical regulation and operational risk.

• Fluent Portuguese and advanced English (spoken and written).

Preferred requirements (not mandatory)

• Coordinate and support the corporate Information Security Risk Management process, ensuring its consistent application across assets, services, projects, processes, and third parties/service providers;
• Ensure the quality, consistency, and traceability of risk assessments, validating scenarios, threats, vulnerabilities, controls, impacts, and risk levels;
• Manage the Corporate Information Security Risk Register, ensuring classification, updates, traceability, and linkage to controls, requirements, treatment plans, and evidence;
• Support the definition and prioritization of risk treatment plans, ensuring the adequacy of mitigation measures to exposure, criticality, and applicable requirements;
• Monitor the implementation and effectiveness of mitigation and remediation actions, tracking owners, deadlines, deviations, and residual risks;
• Consolidate and analyze risk information from multiple sources, identifying trends, relevant exposures, and decision needs;
• Produce executive reporting, dashboards, and risk indicators, supporting the monitoring of risk exposure, control effectiveness, and the progress of treatment plans;
• Perform gap assessments, support audits, inspections, and compliance initiatives;
• Collaborate with internal and external stakeholders and contribute to the continuous improvement of the function, promoting Information Security risk methodologies, processes, tools, and culture.

Working arrangement: Hybrid (between 2-3x per week in the office)

Noesis is looking for professionals with the following profile: