Job ID

301917

Romania

Bucuresti

Bucharest

Remote vs. Office

Hybrid (Remote/Office)

Company

Siemens Energy S.r.l.

Organization

Grid Technologies

Business Unit

Solutions

Full / Part time

Full-time

Experience Level

Professional / Experienced

A Snapshot of Your Day

In your role as Industrial Cybersecurity Risk Analyst, you will make risk tangible. You will provide Cybersecurity Threat and Risk Analysis (TRA) as a service through our team, helping to protect the IT and OT systems behind critical energy transmission. By identifying, evaluating, and prioritizing cybersecurity risks across Grid Solutions projects and systems, you will enable informed decision-making and support the implementation of effective risk mitigation strategies. Together with project members and security specialists, you will facilitate TRA workshops and translate their outcomes into clear, prioritized risks and actionable mitigation measures. As part of a global team of cybersecurity experts, you will gain diverse perspectives, continuously exchange knowledge, and learn from colleagues around the world. Additionally, you will have opportunities for personal development and career growth, learning new things, staying up to date, and developing knowledge outside of your domain.

How You’ll Make an Impact

• Providing threat & risk analysis as a service: Planning, conducting, and documenting Cybersecurity Threat and Risk Analyses (TRA) for IT and OT systems, products, and architectures across Grid Solutions, ranging from customer and R&D projects to individual components.
• Identifying and prioritizing risks: Performing comprehensive risk assessments to identify, evaluate, and prioritize cybersecurity risks, including the analysis of threat scenarios, attack vectors, threat actors, exposure, exploitability, impact, and inherent and residual risk levels.
• Moderating Threat and Risk Analysis Workshops: Leading and moderating TRA workshops in collaboration with senior project stakeholders, subject matter experts, and cybersecurity specialists to ensure comprehensive risk identification and assessment.
• Managing Risk Mitigation and Residual Risk Acceptance: Recommending risk-based mitigation strategies, monitoring their implementation, and ensuring that residual risks are formally reviewed, documented, and accepted in accordance with established governance processes.
• Maintaining Risk Governance and Transparency: Developing and maintaining Threat and Risk Analyses, Security Risk Registers, and risk treatment documentation to ensure traceability, regulatory compliance, and audit readiness throughout the project lifecycle.
• Strengthening the methodology: Contributing to the continuous enhancement of TRA methodologies, processes, templates, workflows, and supporting tools to improve effectiveness, consistency, and efficiency.
• Supporting project and R&D teams: Providing expert guidance on identified risks and recommended countermeasures to customer project and R&D teams, enabling informed decision-making and secure-by-design implementation.
• Ensuring compliance: Interpreting and applying relevant cybersecurity standards, regulations, and industry frameworks, including IEC 62443, the Cyber Resilience Act (CRA), NIS2, NERC CIP, and the BDEW Whitepaper, and translating their requirements into practical risk management activities.

What You Bring

• University degree in IT Security, Computer Science, Cybersecurity, Electronics, Electrical Engineering with focus on IT Security or a comparable qualification with extensive professional experience in OT or product security.
• Solid knowledge of relevant cybersecurity standards and regulations (e.g., ISA/IEC 62443 (especially risk assessment, 62443-3-2/-3-3), CRA, NERC CIP, BDEW Whitepaper, ISO27001/27005).
• Experience in cybersecurity threat and risk assessment, threat modeling and risk prioritization in OT or product security.
• Understanding of industrial control systems, network architectures and protocols, and how security risks manifest in operational environments.
• Experience in facilitating Threat and Risk Analysis (TRA) workshops and effectively engage multidisciplinary stakeholders across project, engineering, and cybersecurity functions.
• Strong analytical and structured way of working with the ability to translate complex technical information into clear, prioritized risk assessments and actionable recommendations.
• Certifications such as ISA/IEC 62443, CEH, CySA+ or similar are a plus (no hard requirement).
• Capability of multitasking, with excellent organizational skills while assuring a high-quality work process.
• Intercultural sensitivity, to work in (virtual) international team.
• Strong interpersonal and teamwork skills, ability to analyze and learn as well as motivation, result orientation and enthusiasm to make a positive contribution to the team.
• Fully conversant with Microsoft – Word, Excel, Outlook, PowerPoint, Visio
• Business-level fluency in English. German skills will be beneficial.
• Willingness to travel internationally (<30%)