网络安全风险分析师 - 摩尔多瓦
Cybersecurity Risk Analyst - Moldova
Yopeso 20 年来一直在开发各种软件产品，从大型应用程序到小型解决方案。随着我们在五个地点的团队规模不断扩大，员工超过 300 人，我们致力于培养成长、透明和专业的企业文化。
在 Yopeso，我们重视真实、好奇和雄心。这些价值观促使我们与社区和合作伙伴建立牢固的联系，确保所有业务实践中的信任、诚信和透明度。我们努力保持最高的专业标准，并不断挑战自己，开发高质量、高性能和安全的软件解决方案。
我们的方法植根于充满热情的专业人士在敏捷团队中的高效协作。在好奇心和雄心的指引下，我们努力打造有意义且有影响力的产品，同时保持真实的自我。
我们提供的福利：
- 具有竞争力的薪酬
- 远程办公
- 运动/休闲福利
- 20 天带薪病假
- 32 天带薪年假
- 团队活动，线上、办公室或户外
- 有指导和辅导的专业发展计划
- 有预算支持的培训和发展机会
- 职业认证
- 可选的医疗保险
要求
作为网络安全风险分析师，你将在广泛的电网解决方案项目中发挥关键作用，包括研发项目、产品开发（硬件和软件）以及全范围的关键基础设施系统，如HVDC、HVAC、消防等。
通过识别、评估和优先处理网络安全风险，你将与多个团队合作，确保潜在威胁被尽早发现，并实施适当的缓解措施。你的工作将直接促进项目执行、安全合规性和市场准备度。
你将产生的影响
- 提供威胁与风险分析服务：为电网解决方案项目中的 IT 和 OT 系统及产品进行网络安全威胁与风险分析的规划和执行。
- 识别并优先处理风险：在各个项目和系统中识别、评估并优先处理网络安全风险；评估风险情景、攻击路径和攻击者类型，包括暴露程度、可利用性、影响、固有风险和剩余风险。
- 主持 TRA 工作坊：组织和主持威胁与风险分析研讨会，引导团队进行深入讨论和风险评估。
查看英文原文
Yopeso has been developing a diverse range of software products, from large-scale applications to smaller solutions, for 20 years. With a growing team of over 300 employees across five locations, we are dedicated to fostering a culture of growth, transparency, and professionalism.
At Yopeso, we value authenticity, curiosity, and ambition. These values drive us to build strong connections within our community and with our partners, ensuring trust, integrity, and transparency in all our business practices. We strive to maintain the highest professional standards and continuously challenge ourselves to develop high-quality, high-performance, and secure software solutions.
Our approach is rooted in efficient collaboration among passionate professionals working in agile teams. Guided by curiosity and ambition, we strive to create products that are meaningful and impactful, while remaining true to our authentic selves.
What we offer:
- Competitive remuneration
- Remote work
- Sports/leisure benefit
- 20 sick leave days paid at 100%
- 32 calendar days of vacation
- Team events, online, at the office, or outside
- Professional development plan with guidance and mentorship
- Training and development opportunities with an allocated budget
- Professional Certifications
- Optional medical insurance
Requirements
As a Cybersecurity Risk Analyst, you will play a crucial role in conducting Threat and Risk Assessments (TRA) for a wide range of Grid Solutions projects, including R&D initiatives, product development (hardware & software), and full-scope critical infrastructure systems such as HVDC, HVAC, Firefighting, and more.
By identifying, assessing, and prioritizing cybersecurity risks, you will collaborate with various teams to ensure that potential threats are detected early and that appropriate mitigation measures are implemented. Your work will contribute directly to improving project execution, security compliance, and market readiness.
How You’ll Make an Impact
- Providing threat & risk analysis as a service: Planning and performing Cybersecurity Threat and Risk Analyses for IT and OT systems and products across Grid Solutions projects.
- Identifying and prioritizing risks: Identifying, evaluating, and prioritizing cybersecurity risks across projects and systems; assessing risk scenarios, attack vectors, and attacker types along exposure, exploitability, impact, inherent and residual risk.
- Moderating TRA workshops: Facilitating threat and risk analysis workshops together with senior project members and security specialists as TRA moderator.
- Tracking mitigation and residual risk: Recommending risk-based measures, tracking mitigation, and ensuring residual risks are formally reviewed and accepted.
- Maintaining risk transparency: Producing and maintaining the Threat and Risk Analysis, Security Risk Register and risk treatment documentation to ensure traceability, compliance and audit readiness.
- Strengthening the methodology: Continuously improving the TRA process, templates, workflows and tooling (e.g., the PSS Threat and Risk Tool).
- Supporting projects and engineering teams: Sharing identified risks and possible countermeasures with project and engineering teams as input for their decisions.
- Ensuring compliance: Translating relevant standards and regulations into practical risk work (e.g., IEC 62443, CRA, NIS-2, NERC CIP, BDEW Whitepaper).
What You Bring
- Completed studies: Bachelor or Master in IT Security, Computer Science, Electrical Engineering with a focus on IT Security, or a comparable qualification with relevant professional experience.
- Expertise in risk analysis: Experience in cybersecurity threat and risk assessment, threat modeling and risk prioritization in OT or product security.
- Knowledge of standards: Familiarity with ISA/IEC 62443 (especially risk assessment, 62443-3-2/-3-3), and others such as CRA, NIS-2, NERC CIP, BDEW Whitepaper, ISO 27001/27005.
- OT/ICS understanding: Understanding of industrial control systems, network architectures and protocols, and how security risks manifest in operational environments.
- Workshop facilitation: Ability to moderate TRA workshops and align multidisciplinary stakeholders from project, engineering, and security.
- Analytical mindset: Strong analytical and structured way of working; able to translate technical detail into clear, prioritized risk statements.
- Communication skills: Proficient in English, with a high level of initiative and the ability to communicate risk to technical and non-technical stakeholders (German is a plus).
- Desirable certifications: Certifications such as ISA/IEC 62443, CEH, CySA+, or similar are a plus (no hard requirement).
Originally posted on Himalayas