Senior IT Risk Officer

About the role

Eurofins Scientific is hiring a Senior IT Risk Officer in Barcelona. You will identify, assess and reduce IT and cybersecurity risks across Eurofins' European businesses, working independently on IT risk assessments across laboratories, business units and IT environments, in close collaboration with IT, security and business teams. The role involves frequent travel across Europe, about 35-50% of the time.

Key responsibilities

• Independently plan and carry out IT and cybersecurity risk assessments across laboratories, regional infrastructure and central IT services.
• Assess technical and organisational controls covering network security, identity and access management, endpoint security, vulnerability management, cloud, logging and monitoring, backup and IT resilience.
• Identify technical weaknesses, challenge existing controls where needed and turn technical findings into clear business risks and practical recommendations.
• Produce quality reports, present results to technical teams and management, and follow up on agreed remediation actions.
• Contribute to improving IT risk assessment methodologies and to security and resilience initiatives such as phishing campaigns and IT resilience exercises.
• Maintain strong relationships with IT, security and business stakeholders.

Required profile

• 3-7 years of experience in cybersecurity, information security, IT risk, IT audit or a related technical IT control function.
• Experience performing IT risk assessments, security assessments or technical IT audits.
• University degree in Computer Science, Cybersecurity, Information Systems, Engineering or another relevant field, or equivalent professional experience.
• Excellent written and verbal English, with strong stakeholder management and negotiation skills.
• Willingness to travel frequently across Europe.

Required skills

• Networking, firewalls, Active Directory / Entra ID, IAM/MFA, endpoint security, vulnerability management, Windows/Linux infrastructure, cloud security, SIEM/logging, backup and disaster recovery.
• Knowledge of NIS2, EU data protection requirements and common cybersecurity frameworks is an advantage.
• Certifications such as CISSP, CISM, CISA, CRISC or ISO 27001 are an advantage but not mandatory.