Third Party Security Analyst

You have

• Minimum 4 to 8 years of experience in cybersecurity, information security, risk management, audit, compliance, or third-party risk management. 
• Strong understanding of third-party risk management principles, supplier security assurance, and security governance practices.
• Experience conducting security assessments, control reviews, or risk evaluations in enterprise environments.
• Strong understanding of information security controls and common security domains, including access management, vulnerability management, incident management, data protection, and cloud security.
• Knowledge of security and risk management frameworks such as ISO/IEC 27001, ISO/IEC 27002, ISO 31000, NIST Cybersecurity Framework, CIS Controls, COBIT, and similar industry standards. 
• Ability to analyze security risks and communicate findings clearly to both technical and non-technical stakeholders. 
• Strong analytical, problem-solving, and critical-thinking capabilities. 
• Excellent stakeholder management and collaboration skills.
• Strong written and verbal communication skills in English. 
• Master's degree in Cybersecurity, Information Technology, Computer Science, Engineering, Risk Management, or related discipline. 

It Would Be Nice If You Also Had

• Experience working with supplier security assessment platforms and GRC solutions.
• Knowledge of cloud security concepts and security assessments of SaaS, PaaS, and IaaS providers.
• Experience in telecommunications, technology, or large multinational organizations.
• Knowledge of data protection and privacy requirements affecting third-party engagements.
• Relevant certifications such as CISSP, CISM, CRISC, ISO 27001 Lead Implementer/Auditor, or equivalent. 
• Experience working in global, matrixed organizations. 

You Are

• A trusted security professional with a strong risk-management mindset.
• Customer-focused and capable of building constructive relationships with internal and external stakeholders. 
• Highly organized, self-motivated, and proactive.
• Comfortable managing multiple assessments and priorities simultaneously.
• An effective communicator who can translate technical risks into business-relevant recommendations. 
• A collaborative team player who works effectively across diverse and virtual teams. 
• Focused on delivering practical, sustainable, and risk-based security outcomes.

Responsibilities include, but are not limited to:

• Conducting security assessments of suppliers, service providers, and other third parties using established risk assessment methodologies and security frameworks.
• Reviewing third-party security documentation, certifications, audit reports, and control evidence to evaluate security maturity and compliance with Nokia requirements.
• Identifying security risks and control gaps and documenting impact, likelihood, and recommended remediation actions.

• Assess security risks associated with third parties providing AI-enabled services, cloud-native platforms, and outsourced digital services.

• Working with suppliers and business stakeholders to define, track, and validate risk treatment and remediation plans.
• Supporting supplier onboarding, periodic reassessments, and ongoing security assurance activities throughout the third-party lifecycle.
• Providing risk-based recommendations to business owners, procurement teams, and management to support informed decision-making.
• Maintaining third-party risk records, assessment results, exceptions, and security metrics within designated governance processes and tools.
• Monitoring remediation progress and reporting on outstanding risks, assessment status, key metrics, and trends.
• Supporting the continuous improvement of third-party risk management processes, methodologies, standards, and operating procedures.
• Creating awareness of third-party security risks and promoting security best practices among internal stakeholders and suppliers.
• Collaborating with procurement, legal, compliance, privacy, audit, and Information Security teams to ensure consistent management of third-party security requirements.
• Supporting audit activities, compliance reviews, and regulatory initiatives related to supplier security and third-party risk management.
• Staying informed of emerging cyber threats, vulnerabilities, industry trends, and regulatory developments that may impact supplier security risk exposure.
• Contributing to executive and operational reporting regarding third-party security posture, risks, and remediation progress.

You have

• Minimum 4 to 8 years of experience in cybersecurity, information security, risk management, audit, compliance, or third-party risk management.
• Strong understanding of third-party risk management principles, supplier security assurance, and security governance practices.
• Experience conducting security assessments, control reviews, or risk evaluations in enterprise environments.
• Strong understanding of information security controls and common security domains, including access management, vulnerability management, incident management, data protection, and cloud security.
• Knowledge of security and risk management frameworks such as ISO/IEC 27001, ISO/IEC 27002, ISO 31000, NIST Cybersecurity Framework, CIS Controls, COBIT, and similar industry standards.
• Ability to analyze security risks and communicate findings clearly to both technical and non-technical stakeholders.
• Strong analytical, problem-solving, and critical-thinking capabilities.
• Excellent stakeholder management and collaboration skills.
• Strong written and verbal communication skills in English.
• Master's degree in Cybersecurity, Information Technology, Computer Science, Engineering, Risk Management, or related discipline.

It Would Be Nice If You Also Had

• Experience working with supplier security assessment platforms and GRC solutions.
• Knowledge of cloud security concepts and security assessments of SaaS, PaaS, and IaaS providers.
• Experience in telecommunications, technology, or large multinational organizations.
• Knowledge of data protection and privacy requirements affecting third-party engagements.
• Relevant certifications such as CISSP, CISM, CRISC, ISO 27001 Lead Implementer/Auditor, or equivalent.
• Experience working in global, matrixed organizations.

You Are

• A trusted security professional with a strong risk-management mindset.
• Customer-focused and capable of building constructive relationships with internal and external stakeholders.
• Highly organized, self-motivated, and proactive.
• Comfortable managing multiple assessments and priorities simultaneously.
• An effective communicator who can translate technical risks into business-relevant recommendations.
• A collaborative team player who works effectively across diverse and virtual teams.
• Focused on delivering practical, sustainable, and risk-based security outcomes.