IT Security & Risk Officer

Long Description

Enterprise Cybersecurity secures the IT journey for Volvo Group by working with Business Areas, Truck Divisions, and Group Functions in a global environment.

As IT Security & Risk Officer - Associate, you will help shape how we secure IT assets. You will advise Group Digital & IT on applying security requirements and architecture principles in solution designs, identify weaknesses, and propose mitigations. The role also includes awareness and education, working with developers, architects, and DevOps teams to build effective security measures, policies, procedures, and solutions.

Key responsibilities

• Drive strategic and tactical IT security direction.
• Assess risks, identify vulnerabilities, evaluate impact, and recommend mitigations.
• Advise on solution design and review solution blueprints.
• Develop, update, and enforce security policies, procedures, and guidelines in line with industry and regulatory requirements.
• Perform gap analyses against frameworks such as ISO, ISF, CSA [TS1.1], NIST, etc.
• Identify, assess, and implement IT/OT security controls across projects and organizations.
• Collaborate with stakeholders in a multicultural environment.
• Act as a trusted advisor on security best practices and integrate security into design and implementation.
• Monitor framework effectiveness and recommend improvements based on emerging threats.
• Ensure adherence to information protection laws and regulations.
• Review the coverage and effectiveness of IT and OT security controls.
• Stay current on IT security trends and advancements.

Your background
You have broad IT Security experience and understand the challenges facing large enterprises such as Volvo Group. Strong stakeholder management and the ability to build trusted relationships internally and externally are essential.

You have

• Strong critical thinking and analytical skills.
• Experience driving change and influencing others.
• Excellent communication and presentation skills.
• Adaptability and resilience in a changing security landscape.
• Strong listening, collaboration, and teamwork skills.
• Curiosity and enthusiasm for innovation and continuous improvement.

Hard skills and knowledge

• Knowledge of cybersecurity frameworks such as ISF, CSA, NIST, SCF, ISO 27x, OWASP, etc.
• Experience with Microsoft Azure services and cloud-based applications.
• Understanding of least privilege and Zero Trust in distributed IT/OT environments.
• Knowledge of on-premise and cloud network security technologies such as segmentation, firewalling, load balancing, and VPN.
• Understanding of on-premises, multicloud, and hybrid interconnecting solutions.
• Experience with AppSec and SDLC practices such as DevSecOps, SAST, SCA, DAST, and container security.
• Knowledge of cloud security, container security, API security, Infrastructure as Code, and IAM technologies such as OAuth2/OIDC.
• Security certification such as ISC2 CC/SSCP, CompTIA Security+, Microsoft Azure AZ-900/AZ-500, or similar.

Advantageous skills

• Practical experience with threat modelling using standards such as STRIDE, MITRE, OWASP, etc.
• Familiarity with AI development frameworks, model providers, open-source models, or model evaluation platforms.

Minimum education and experience
Bachelor’s or master’s degree in cybersecurity, IT, Information Systems, Engineering, or equivalent experience.
3+ years of experience in IT Operations, Security, Cloud, or Architecture.