Third Party Cyber Assurance Supervisor

About the role

ING Hubs Spain is building a new Cybersecurity organization from the ground up. As Third Party Cyber Assurance Supervisor, you will protect ING against cyber risks arising from external suppliers and service providers supporting critical business operations. The role combines cybersecurity, risk management, technical assessments, supplier assurance, stakeholder management and international exposure, working closely with global CISO teams, suppliers, risk professionals and senior management.

Key responsibilities

• Lead, plan, organize and execute risk-based cybersecurity assessments and onsite inspections of critical third-party providers
• Evaluate the design and effectiveness of suppliers' cybersecurity controls, including security governance, technology controls, operational resilience and risk management practices
• Conduct interviews, documentation reviews, field inspections, configuration assessments and technical security evaluations
• Inspect data centres covering physical security, environmental controls, power paths and fire protection
• Analyze findings and turn technical gaps into business risks and actionable recommendations
• Support security testing such as penetration testing and red teaming, and produce reports and executive dashboards
• Contribute to Third-Party Risk Management and Operational Resilience under DORA and other frameworks, and stay current on threats and best practices
• Identify automation opportunities through agentic AI and coach new team members

Required profile

• Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity, IT Engineering, IT Risk Management or IT Audit
• 7-9 years of experience in Cybersecurity, IT Audit, Cyber Risk Management, Third-Party Risk Management or similar
• Strong knowledge of IT processes, standards and best practices (COBIT, ISO 27001, ISO 22001)
• Understanding of risk management, governance and the Three Lines Model
• Fluent English, ability to work in multicultural environments, and strong communication and stakeholder management skills
• Travel of about 6-8 weeks per year may be required

Required skills

• Cybersecurity technologies, cloud, identity and access management, containers and networking
• Audits, cybersecurity assessments and supplier reviews
• Preferred: DORA, NIST Cybersecurity Framework, ISO 27001, SOC 2, NIS2, penetration testing, red teaming, Nessus, Burp Suite, Kali Linux, Wireshark, Docker, scripting and automation
• Preferred certifications: CISSP, CISA, CEH, OSCP, ISO 27001 Lead Auditor

What we offer

• Flexible working: choose your own home-working days
• Restaurant card, electric mobility solutions, doctor, hairdresser, gym and errand help in the office
• Health and life insurance for you and your family
• Flexible remuneration model and pension plan after 1 month
• Transport allowance and access to nursery, transport card and training aids