IT Security Engineer II - Cybersecurity Risk Management

About the role

Thermo Fisher Scientific is looking for an IT Security Engineer II to join its cybersecurity team and help protect its global enterprise. The role combines hands-on technical work with strategic thinking: monitoring, detecting and responding to security threats, implementing protective measures across network infrastructure, and contributing to information security risk management so that security can influence strategic decisions across the enterprise.

Key responsibilities

• Help develop and implement a global cybersecurity risk management program and maintain the risk management policy through the full risk lifecycle
• Run risk analysis processes: intake and analysis of reported risks, risk measurement, risk response, and tracking action plans of risk owners
• Execute third-party security assessments, vendor and supplier assessments, and third-party risk management activities
• Conduct information security assessments and risk assessments of technology solutions, documenting controls, identifying gaps and recommending improvements
• Oversee the definition and implementation of security controls and requirements for systems, infrastructure and solutions
• Keep security practices and standards consistent across the organization and produce risk reports for business leaders

Required profile

• 3+ years of experience in risk analysis, information risk management, data privacy, IT or equivalent, with exposure to cybersecurity and information security risk
• Bachelor's degree in Risk Management, Information Assurance, Information Security, Cybersecurity, IT, Data Privacy or similar, or equivalent experience
• Ability to explain complex risk management topics to a broad audience and present to senior leadership
• Self-directed, able to complete work with minimal direction; excellent written and verbal communication and documentation skills

Required skills

• Experience with risk analysis
• General understanding of cybersecurity technologies and controls, bridging governance and technical concepts
• Knowledge of risk management frameworks such as NIST RMF or CIS Risk Assessment Methodology is a plus
• Certifications such as CRISC, CISSP or CISA are a plus; writing or technical editing experience is a plus