Job Description

At Chain IQ, your ideas move fast.

Chain IQ is a global AI-driven Procurement Service Partner, headquartered in Baar, Switzerland, with operations across main centers and 16 offices worldwide. We provide tailored, end-to-end procurement solutions that enable transformation, drive scalability, and deliver substantial reductions in our clients' indirect spend. Our culture is built on innovation, entrepreneurship, ownership, and impact. Here, your voice matters - bold thinking is encouraged, and action follows ambition.

Role Purpose

The IT Risk & Security Officer is responsible for identifying, assessing, and mitigating technology and information security risks across the organization. The role works closely with IT, Security, Legal, Risk, Procurement, and business stakeholders to ensure security controls are effective, regulatory and contractual obligations are met, and security requirements are embedded into business processes, projects, and third-party relationships.

The position plays a key role in strengthening the organization's overall security posture while enabling business growth and operational resilience.

Key Responsibilities

• Identify, assess, document, and monitor IT and information security risks, including remediation plans, risk acceptances, and exceptions.
• Support the development, implementation, and maintenance of information security policies, standards, and controls.
• Perform IT risk and security control assessments and track remediation activities for identified gaps.
• Monitor and report key security and risk metrics, including KRIs and KPIs, to relevant stakeholders.
• Support internal and external audits, certifications, and compliance assessments, including evidence collection and remediation follow-up.
• Ensure security requirements are integrated into projects, systems, and business processes throughout their lifecycle.
• Conduct third-party security assessments and evaluate the security posture of suppliers and service providers.
• Review security documentation and assurance reports, including SOC 2 reports, security questionnaires, and related evidence.
• Support the review of client and supplier contracts from an information security perspective, including security requirements, audit rights, and incident notification obligations.
• Collaborate with cross-functional teams to continuously improve the organization's IT risk management and information security framework.

Requirements

• Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity, Information Technology, Risk Management, or a related discipline.
• Minimum 3 years of experience in IT Risk, Information Security, Cybersecurity, GRC, or a similar field.
• Good understanding of information security and risk management frameworks, particularly ISO 27001, ISO 27002, and SOC 2.
• Experience conducting IT risk assessments, control reviews, risk treatment activities, and remediation tracking.
• Knowledge of third-party risk management and supplier security assessment processes.
• Experience reviewing security requirements within client contracts, security questionnaires, or due diligence processes is an advantage.
• Familiarity with frameworks such as NIST Cybersecurity Framework, CIS Controls, or similar industry standards.
• Understanding of key security domains, including Identity & Access Management, vulnerability management, cloud security, data protection, incident management, and business continuity.
• Strong analytical, communication, and stakeholder management skills, with the ability to translate technical risks into business impact.
• Professional certifications such as CISSP, CISM, CRISC, or ISO 27001 Lead Implementer/Lead Auditor are considered a plus.

Join a truly global team.

We offer a dynamic and international environment where high performance meets real purpose. We're proud to be Great Place to Work-certified and even prouder of the people who make that possible. Let’s shape the future of procurement - together.

Chain IQ – Create. Lead. Make an impact.

Information for agencies: Applications sent or uploaded by placement agencies or similar are not desired, will therefore not be considered and will be deleted.