Cyber Risk Manager

Samenvatting

De TU/e zoekt een ervaren Cyber Risk Manager die de cyberrisicomanagementcapaciteit binnen de organisatie substantieel opschaalt ter voorbereiding op NIS2 en ISO27001-certificering.

Je werkt binnen het GRC-team van Library and Information Services en rapporteert aan de GRC-manager, met als doel een robuuste PDCA-gestuurde risicoprocesinrichting op te leveren.

Belangrijke verantwoordelijkheden zijn het ontwikkelen van een uniforme cyberrisicomethodiek, uitvoeren van risicoanalyses en BIAs, opstellen en volgen van risicoregisters en behandelplannen, en het inrichten van dashboards en managementrapportages.

Daarnaast lever je input voor business continuity, disaster recovery en resilience-activiteiten, zorg je voor audit- en compliance-bewijsvoering en draag je kennis over aan interne collega’s zodat TU/e blijvend zelfvoorzienend wordt.

De rol vereist korte lijnen met dienst- en systeem-eigenaren, vertalen van technische risico’s naar impact op onderzoek en onderwijs, en het realiseren van concrete, proportionele verbeteringen vóór juli 2028.

Vereist profiel

• Ruime ervaring met cyberrisicobeoordelingen: aantoonbare ervaring met het bepalen van waarschijnlijkheid, impact, inherente en residuele risico’s en het formaliseren van risicoeigenaarschap.
• Ervaring met Business Impact Analyses: inzicht in operationele, financiële, juridische, reputatie-, veiligheids- en informatiebeveiligingsgevolgen; bekend met RTO’s en RPO’s.
• Kennis van ISO 27001 en NIS2: praktische ervaring met eisen rond risicomanagement, incidentafhandeling, continuïteit, supply-chain security, auditbaarheid en managementverantwoording.
• Sterke analytische en gestructureerde werkwijze: ervaring met risicoregisters, dashboards, rapportages en GRC-tooling; oog voor datakwaliteit en consistentie.
• Uitstekende stakeholdermanagement- en facilitatievaardigheden: vermogen om effectief te werken met service owners, onderzoekers, engineers en management en technische risico’s in bedrijfstaal uit te leggen.
• Pragmatisch en resultaatgericht: focus op proportionele oplossingen, minimaliseren van administratieve lasten en het realiseren van meetbare verbeteringen in de PDCA-cyclus.
• Oriëntatie op de academische omgeving: begrip van onderzoeks- en onderwijsprocessen, laboratoria, onderzoeksinfrastructuur en OT, en het vermogen om security, bruikbaarheid en onderzoeksdoelen te balanceren.
• Communicatie en kennisoverdracht: ervaring met trainen en begeleiden van interne risk owners en GRC-teams zodat continuïteit en zelfstandigheid worden gewaarborgd.
• Taalvaardigheid: uitstekende beheersing van het Engels (werktaal) en goede beheersing van het Nederlands is een pre.

Aanvullende voorwaarden

• Inschrijven als zelfstandige zonder personeel (zzp) voor deze opdracht is niet toegestaan; alle verplichtingen ten aanzien van personeel blijven bij de opdrachtnemer liggen.
• De inschrijver moet kunnen aantonen dat hij personeel mag uitlenen en voldoet aan de Wet allocatie arbeidskrachten door intermediairs (Waadi) door middel van een uittreksel uit het Handelsregister.

Eisen

• • A documented and practical risk assessment methodology aligned with ISO 27001, ISO 27005, NIS2, and the TU/e risk management framework.
• • Standard templates, scoring criteria, risk categories, impact scales, and guidance for assessing inherent and residual risk.
• • Clear criteria for risk acceptance, escalation, treatment, and management approval.
• • Risk assessments for agreed critical services, systems, projects, suppliers, research environments, and organisational units.
• • Clear documentation of assets, threats, vulnerabilities, existing controls, risk scenarios, likelihood, impact, and residual risk.
• • Prioritised findings and recommendations that can be translated into concrete improvement actions.
• • Formal identification of risk owners and action owners.
• • Completed BIAs for critical education, research, operational, and supporting processes.
• • Identification of critical activities, supporting systems, data, suppliers, facilities, people, and other dependencies.
• • Documented impact assessments covering operational, financial, legal, regulatory, reputational, safety, and information-security consequences.
• • Defined Maximum Tolerable Periods of Disruption, recovery priorities, Recovery Time Objectives, and Recovery Point Objectives.
• • An up-to-date and structured cyber and IT risk register.
• • Documented risk treatment plans, including actions, priorities, responsible owners, deadlines, and target risk levels.
• • Formal records of accepted, transferred, avoided, or mitigated risks.
• • Monitoring of overdue actions, unresolved risks, and risks exceeding the approved risk appetite.
• • Periodic management reports on the overall cyber-risk exposure of LIS and TU/e.
• • Dashboards showing risk levels, trends, critical risks, treatment progress, overdue actions, and risk acceptance decisions.
• • Clear escalation reports for risks requiring management or executive decision-making.
• • Reporting that supports ISO 27001 management reviews and NIS2 governance responsibilities.
• • A functioning risk management cycle covering identification, assessment, treatment, monitoring, review, and improvement.
• • Defined review frequencies and triggers for reassessment, such as major changes, incidents, new threats, projects, or supplier changes.
• • Evidence that risk assessments and BIAs are periodically reviewed and kept current.
• • Recommendations for improving the maturity and consistency of risk management across TU/e.
• • Recovery and continuity requirements based on BIA outcomes.
• • Prioritised recommendations for business continuity, disaster recovery, crisis management, backup, redundancy, and cyber resilience.
• • Identification of gaps between required and actual recovery capabilities.
• • Input for continuity plans, disaster-recovery plans, crisis exercises, and resilience testing.
• • Documented evidence demonstrating that cyber risks are systematically identified, assessed, treated, monitored, and reviewed.
• • Traceability between risks, ISO 27001 controls, NIS2 obligations, policies, and improvement actions.
• • Audit-ready documentation supporting internal audits, external certification, regulatory supervision, and management accountability.
• • Support for the preparation and follow-up of ISO 27001 and NIS2 assessments.
• • Workshops, guidance, and practical training for service owners, risk owners, project managers, researchers, and technical teams.
• • Clear instructions explaining roles, responsibilities, assessment methods, and expected evidence.
• • Transfer of knowledge to the internal Risk Manager and GRC team.
• • Increased stakeholder capability to independently identify, assess, and manage cyber risks.
• • At minimum, the assignment should result in:
• • An approved cyber-risk assessment methodology.
• • Standard risk assessment and BIA templates.
• • A prioritised portfolio of completed risk assessments and BIAs.
• • An updated risk register with assigned ownership.
• • Approved risk treatment and risk acceptance records.
• • A management dashboard and periodic reporting cycle.
• • A documented risk PDCA process.
• • Integration of risk management into relevant project and change processes.
• • An improvement roadmap for remaining ISO 27001 and NIS2 risk-management gaps.
• • Ability to identify assets, threats, vulnerabilities, dependencies, and existing controls.
• • Experience assessing likelihood, impact, inherent risk, and residual risk using a consistent methodology.
• • Ability to translate identified risks into practical mitigation measures, formal risk acceptance, and clear ownership.
• • Understanding of risk appetite, risk tolerance, and escalation criteria.
• • Ability to identify critical education, research, IT, and business processes.
• • Experience assessing the operational, financial, legal, reputational, safety, and information-security impact of disruption.
• • Ability to determine maximum tolerable downtime, recovery priorities, critical dependencies, Recovery Time Objectives and Recovery Point Objectives.
• • Ability to translate BIA outcomes into business continuity, disaster recovery, and resilience requirements.
• • Strong working knowledge of ISO 27001, ISO 27005, and information-security risk management.
• • Understanding of NIS2 requirements relating to risk management, incident handling, business continuity, supply-chain security, governance, and management accountability.
• • Ability to link identified risks to applicable ISO 27001 controls and NIS2 obligations.
• • Experience supporting auditability, evidence collection, risk reporting, and continuous improvement.
• • Ability to bring structure to complex and decentralised IT environments.
• • Strong analytical skills and attention to the quality and consistency of risk and BIA data.
• • Ability to identify cross-organisational dependencies, concentration risks, and systemic risks.
• • Experience with risk registers, dashboards, reporting, and GRC tooling.
• • Strong workshop and interview skills for facilitating risk assessments and BIAs.
• • Ability to engage effectively with service owners, researchers, architects, engineers, project managers, and management.
• • Ability to challenge stakeholders constructively while maintaining trust and cooperation.
• • Strong communication skills and the ability to explain cyber risks in clear business language.
• • Ability to translate frameworks and regulatory requirements into workable processes.
• • Focus on proportionality, avoiding unnecessary complexity and administrative burden.
• • Ability to embed risk management into projects, changes, procurement, architecture, and service management.
• • Strong ownership and follow-up skills to ensure that risk treatment actions are completed.
• • Ability to work in a highly autonomous and decentralised university environment.
• • Understanding of the specific needs of scientific research, education, laboratories, research infrastructure, and operational technology.
• • Sensitivity to academic freedom, innovation, data sovereignty, and the need for flexible IT solutions.
• • Ability to balance security, compliance, resilience, usability, and research objectives.