We are looking for someone to join our Product Security project and be responsible for developing and maintaining a central catalog of security controls.
The project focuses on analyzing, organizing, and harmonizing security requirements derived from various standards, frameworks, and regulations. A key aspect of the role will be mapping requirements and defining a common set of security controls that will standardize the approach to Product Security within the organization.
In this role, You will work with standards and frameworks such as NIST, IEC 62443, and AI Security, and collaborate with experts in Product Security, Architecture, and Compliance.
Your responsibilities:
- analyzing and comparing security requirements derived from various standards, frameworks, and regulations,
- creating and developing a central Security Controls Catalog,
- mapping and harmonizing security controls across different frameworks, including NIST, IEC 62443, and AI Security,
- identifying the most stringent requirements and translating them into a common set of security controls,
- ensuring full traceability between source requirements and the controls in the catalog,
- collaborating with experts and teams in Product Security, Architecture, and Compliance teams,
- developing a process for managing, maintaining, and updating the catalog,
- supporting process automation by creating a solution that facilitates mapping and reporting, e.g., using Excel VBA.
Must have requirements:
- Experience in analyzing and defining security controls
- Knowledge of NIST 800-53 and IEC 62443
- Security Requirements Engineering
- Security Controls Mapping / Framework Mapping
- Security Compliance / Regulatory Compliance
- Ability to analyze and harmonize security requirements from multiple sources
- Experience in creating documentation and requirement catalogs
- Very good English (C1)
- Independence and ability to work with multiple stakeholders
Nice to have requirements:
- AI Security
- NIST AI RMF
- Cyber Resilience Act (CRA)
- Experience in Medical Device Security
- Experience in Product Security Governance
- Traceability Management
- Technical Writing
- Remote or hybrid work from one of our office in Warsaw, Poznań, Lublin, Katowice or Rzeszów.
- Proficiency in Polish and English at the C1 level is essential.
- We hereby inform you that Inetum Polska sp. z o.o. has implemented an internal reporting (whistleblowing) procedure. The content of the procedure and the possibility to submit an internal report are available at: https://inetum.whispli.com/speakup?locale=pl