> Markdown version of [/jobs/ext/3837797-vacature-cyber-risk-grc-analyst](https://www.wearedevelopers.com/jobs/ext/3837797-vacature-cyber-risk-grc-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Vacature Cyber Risk & GRC Analyst

- **Company:** Breda Bij Newcold
- **Location:** Netherlands
- **Experience:** Experienced
- **Contract:** Permanent contract
- **Skills:** Asana, JIRA, Information Systems, National Institute of Standards and Technology Cybersecurity Framework, CIS Benchmarks, Servicenow
- **Published:** October 20, 2026
- **Apply:** https://www.aplitrak.com/?adid=Y3Jpc3RpbmEucmFkdS40OTM0MC4xMjIxNUBuZXdjb2xkLmFwbGl0cmFrLmNvbQ

## About the Role

We're looking for someone who's actually run a risk register under time pressure, not just someone who can talk fluently about frameworks.

Must-have experience:

 * 3-5 years in cyber security risk management, IT risk, or GRC, in a regulated or complex enterprise environment.
 * Hands-on risk register ownership: risk articulation, scoring, treatment tracking, and producing executive-ready reporting.
 * Supplier/third-party risk assessment execution: questionnaire-based due diligence, evidence review, and posture evaluation, done independently and at volume.
 * High-volume triage: proven ability to prioritize a busy intake queue based on risk and business impact, without things slipping.
 * Working knowledge and experience with frameworks such as: ISO/IEC 27001/27002, NIST CSF, or CIS Controls with the ability to map control evidence to risk outcomes.
 * Communication & cross-cultural stakeholder skills: strong written and verbal communication skills, with the ability to adapt tone and approach across internal and external stakeholders, from technical engineers to senior business leaders to third-party suppliers.
 * Comfortable operating across cultures and communication styles given NewCold's multinational footprint, and able to build trust and drive follow-through with stakeholders from different regional and organisational backgrounds.
 * Stakeholder follow-through: comfortable chasing technical teams, procurement, IT, and business stakeholders repeatedly until items close out.

Preferred / nice-to-have:

 * Exposure to supplier tiering, criticality assessment, or ongoing supplier monitoring models.
 * Familiarity with OT/industrial risk concepts (e.g. IEC 62443, Purdue model) would be a plus given NewCold's OT environment.
 * Certified in Risk and Information Systems Control (CRISC).
 * Experience with GRC or workflow tooling (e.g. Archer, ServiceNow GRC, Jira, Monday.com or equivalent).
 * Prior experience operating across multiple regions/time zones.
 * Understanding of risk governance concepts: risk appetite, residual risk, risk acceptance, escalation paths.

## Description

NewCold's cyber risk function is scaling fast: risk assessments, supplier due diligence, and (ISO 27001 and NIS2-driven governance work have grown to a volume that needs a dedicated person to provide the right level of focus.

This role exists to keep that pipeline moving: triaging intake, running the risk register day-to-day, chasing evidence collection, and turning raw risk data into reporting that leadership can act on. It's a hands-on, high-throughput role rather than a strategic or policy-setting one., * Risk register is current, accurately scored, and reporting cadence is reliable without prompting.

 * Supplier risk assessment backlog is under control, with clear tiering and a repeatable evidence-review process.
 * Stakeholders across regions know who to go to and trust the follow-up will happen.