Cyber Risk & GRC Analyst

About the role:

NewCold's cyber risk function is scaling fast: risk assessments, supplier due diligence, and (ISO 27001 and NIS2-driven governance work have grown to a volume that needs a dedicated person to provide the right level of focus.

This role exists to keep that pipeline moving: triaging intake, running the risk register day-to-day, chasing evidence collection, and turning raw risk data into reporting that leadership can act on. It's a hands-on, high-throughput role rather than a strategic or policy-setting one.

We're looking for someone who's actually run a risk register under time pressure, not just someone who can talk fluently about frameworks.

Must-have experience:

• 3–5 years in cyber security risk management, IT risk, or GRC, in a regulated or complex enterprise environment.
• Hands-on risk register ownership: risk articulation, scoring, treatment tracking, and producing executive-ready reporting.
• Supplier/third-party risk assessment execution: questionnaire-based due diligence, evidence review, and posture evaluation, done independently and at volume.
• High-volume triage: proven ability to prioritize a busy intake queue based on risk and business impact, without things slipping.
• Working knowledge and experience with frameworks such as: ISO/IEC 27001/27002, NIST CSF, or CIS Controls with the ability to map control evidence to risk outcomes.
• Communication & cross-cultural stakeholder skills: strong written and verbal communication skills, with the ability to adapt tone and approach across internal and external stakeholders, from technical engineers to senior business leaders to third-party suppliers.
• Comfortable operating across cultures and communication styles given NewCold's multinational footprint, and able to build trust and drive follow-through with stakeholders from different regional and organisational backgrounds.
• Stakeholder follow-through: comfortable chasing technical teams, procurement, IT, and business stakeholders repeatedly until items close out.

Preferred / nice-to-have:

• Exposure to supplier tiering, criticality assessment, or ongoing supplier monitoring models.
• Familiarity with OT/industrial risk concepts (e.g. IEC 62443, Purdue model) would be a plus given NewCold's OT environment.
• Certified in Risk and Information Systems Control (CRISC).
• Experience with GRC or workflow tooling (e.g. Archer, ServiceNow GRC, Jira, Monday.com or equivalent).
• Prior experience operating across multiple regions/time zones.
• Understanding of risk governance concepts: risk appetite, residual risk, risk acceptance, escalation paths.

How success looks like in the first 6 months:

• Risk register is current, accurately scored, and reporting cadence is reliable without prompting.
• Supplier risk assessment backlog is under control, with clear tiering and a repeatable evidence-review process.
• Stakeholders across regions know who to go to and trust the follow-up will happen.