Senior IT Risk Officer

Eurofins

4d•Remote

About The Position

As a Senior IT Risk Officer, you will play a key role in identifying, assessing and reducing IT and cybersecurity risks across Eurofins' European businesses. You will independently perform IT risk assessments across laboratories, business units and IT environments, working closely with IT, security and business teams. This role requires a solid technical understanding of IT infrastructure and cybersecurity, combined with strong risk assessment, communication and stakeholder management skills. In addition to IT risk assessments, you will contribute to broader security and resilience initiatives, including phishing campaigns and IT resilience exercises. The position requires frequent travel across Europe, approximately 35–50% of the time.

Requirements

3–7 years of relevant experience in cybersecurity, information security, IT risk, IT audit or a related technical IT control function.
Experience performing IT risk assessments, security assessments or technical IT audits.
A good understanding of risk management and cybersecurity principles.
A strong general technical understanding of areas such as networking, firewalls, Active Directory / Entra ID, IAM/MFA, endpoint security, vulnerability management, Windows/Linux infrastructure, cloud security, SIEM/logging, backup and disaster recovery.
The ability to understand technical architectures, identify realistic security risks and discuss them credibly with infrastructure and security engineers.
Strong analytical skills and the ability to distinguish significant risks from theoretical or low-impact issues.
Excellent written and verbal communication skills in English, with the ability to communicate technical risks to both technical and non-technical audiences.
Strong stakeholder management and negotiation skills.
A willingness to travel frequently across Europe.

Nice To Haves

Knowledge of NIS2, EU data protection requirements and common cybersecurity frameworks is considered an advantage.
Relevant certifications such as CISSP, CISM, CISA, CRISC, ISO 27001 or equivalent are an advantage but not mandatory.

Responsibilities

Independently planning and conducting IT and cybersecurity risk assessments across laboratories, regional infrastructure and central IT services.
Assessing technical and organizational controls covering areas such as network security, identity and access management, endpoint security, vulnerability management, cloud, logging and monitoring, backup and IT resilience.
Identifying technical weaknesses and evaluating their potential impact on business operations.
Challenging existing technical implementations and security controls where necessary.
Translating technical findings into clear business risks and pragmatic recommendations.
Producing high-quality reports and presenting assessment results to technical teams and management.
Following up on agreed remediation actions and evaluating whether identified risks have been adequately addressed.
Contributing to the continuous improvement of IT risk assessment methodologies.
Maintaining strong relationships with IT, security and business stakeholders.