Information Security Governance Analyst

pInformation Security Analyst /ppbr / /ppWe are looking for a highly talented individual to join the CRIF Information Security Governance function at global level. The candidate will support the organization in strengthening information security governance and in improving the management of strongtechnology-driven cyber risks /strong, with a specific focus on security controls effectiveness. Collaborating with the Chief Information Security Officer, IT Cybersecurity Team and Managers, the Information Security Analyst will work closely with Global Technologies functions and company departments, contributing to strongidentify, assess and mitigate Information Security risks associated with infrastructure, applications and services /strong. /ppThis position is ideal for someone passionate about information security governance and operational risk management, with a strong interest in strongpractical risk management linked to vulnerabilities, misconfigurations and security gaps /strong, and who enjoys continuously learning and sharing knowledge. /ppbr / /ppBusiness Overview: /ppCRIF is a company specializing in credit bureau and business information, outsourcing and processing services, and credit solutions. Established in 1988 in Bologna (Italy), CRIF has an international presence, operating over four continents (Europe, America, Africa, and Asia). More than 10,500 financial institutions, 600 insurance companies, 82,000 business clients, and 1,000,000 consumers use CRIF services in 50 countries daily. /ppThe Information Security Governance function is part of Global Technologies, the CRIF IT division, with over 1500 professionals distributed in 15 countries, managing 29 datacenters and 12 development hubs, committed to delivering value to businesses, driving corporate Digital Transformation through the planning, development, and implementation of end-to-end solutions, adopting leading technologies and methodologies. /ppReporting to the Chief Information Security Officer and working closely with the Cybersecurity team, the Information Security Governance function helps shape a consistent and pragmatic approach to cybersecurity across the organization. It focuses on understanding and addressing technology-driven risks, ensuring they are properly managed and embedded into governance, processes and business initiatives. It also supports customer-facing activities, including audits and security assessments, acting as a trusted point of reference on information security matters. The role acts as a bridge between cybersecurity, IT and business, promoting a solid, risk-aware culture and supporting the organization in making informed and secure decisions. /ppstrongYour Key Responsibilities: /strong /ppReporting to the CRIF Information Security Manager you will be responsible for the following: /pulliContribute to the identification, analysis and mitigation of information security risks, with a strong focus on technology-related risk drivers such as vulnerabilities, misconfigurations, patching gaps and exposure of IT assets, ensuring that remediation actions are effectively tracked and implemented. /liliAssist in Vendor and Third-Party Cybersecurity Management through assessments, audits, and periodic reviews, coordinating security assessments and remediation activities to closure, ensuring compliance with information security standards and contractual requirements. /liliSupport the development, implementation, and revision of Global Technologies Information Security policies, controls, and metrics to ensure compliance with CRIF Corporate Policies. /liliCoordinate with Global Technologies functions to ensure security requirements and controls align with technical needs, constraints, and evolving technology landscape. /liliWork closely with Cybersecurity teams worldwide to build and maintain a unified cybersecurity strategy aligned with global business needs and regulatory requirements. /liliProvide expert input to Global Technologies IT Governance functions to embed security requirements into core IT processes. /liliMaintain proactive engagement with business and staff functions to provide cybersecurity guidance in key initiatives (e.G. Awareness programs, MA integrations, new business initiatives). /liliSupport customer relationships, facilitating audits and responding to client cybersecurity requests and questionnaires. /liliSupport Internal Audit activities, coordinating cybersecurity remediation actions and monitoring control effectiveness. /li /ulpbr / /ppstrongYour Skills and Experience: /strong /pp3+ years of professional experience in Information Security Governance or Cybersecurity. /ppExperience in roles such as Security Advisory, Cybersecurity Project Program Management, IT Control Evaluation or IT Governance is a plus /ppHands-on experience in managing Information Security risk from a technical perspective, with the ability to understand and evaluate risks related to vulnerabilities, system exposures, misconfigurations and weaknesses in security controls (rather than purely theoretical or compliance-driven risk assessments). /ppBasic understanding of vulnerability management processes (e.G. scanning, prioritization, remediation tracking) and their role in defining the organization's cyber risk posture. /ppStrong knowledge of information security principles, frameworks and best practices, and the ability to apply those principles in clear and articulate way; br / experience in understanding regulatory and industry standards such as DORA, ISO standards, CIS, NIST framework, NIS directive, GDPR, etc /ppExperience in authoring security policies, standards, and supporting the measurement of cyber risk posture. /ppSolid understanding of Information Security domains including Infrastructure Network Security, Cloud Security, Application Security, Endpoint Security, Security Operations and Incident Response, DevSecOps, and Data Security. /ppAbility to understand relationships between Enterprise Architecture, business processes, and cybersecurity risks. /ppStrong communication and collaboration skills, with the ability to explain technical risks in a clear and structured way. /ppThe candidate must be a self-starter comfortable with ambiguity, with strong attention to detail, ability to work in a fast-paced, high-energy, and ever-changing environment. /ppbr / /ppWe offer a safe and inclusive environment where colleagues are encouraged to think outside the box. CRIF is committed to creating a diverse, inclusive work environment and promoting equal opportunities throughout the employee life cycle. We aim to attract and retain the best people and embracing gender, age, culture, religion and disability diversity. /ppbr / /ppWhat we offer: /ppType of contract: permanent. /ppThe Annual Salary for this position starts from €38,000 gross per year. /ppThe level of classification will be determined during the selection process based on the candidate’s profile and in accordance with the National Collective Labour Agreement (CCNL) for the Tertiary, Distribution and Services sector. /ppThe final compensation package, including any variable components (such as MBO) or additional benefits, will depend on the assessment of the candidate’s profile against the role requirements. /ppbr / /ppPursuant to Regulation (EU) 2016/679 (“GDPR”), candidates are hereby informed that their personal data will be processed exclusively for purposes related to the management of their application and the selection process. For further information on the processing of personal data and on the exercise of their privacy rights, candidates are invited to consult the full privacy notice available at the following Link, in the “Terms of Use” section, /ppbr / /p