Third Party Security Analyst

Information Security serves as Nokia's center of excellence for cybersecurity, responsible for defining security policies and standards, shaping the cybersecurity architecture and roadmap, and overseeing security monitoring, detection, and incident management. We actively partner with Nokia's Business Segments and Business Functions to protect critical information, strengthen third-party security, and support compliance with internal and external security requirements. In this role, you will join the Third-Party Security team, which is responsible for assessing and managing security risks associated with suppliers, partners, outsourcing providers, and other third parties. The team works closely with procurement, legal, business owners, suppliers, and Information Security stakeholders to ensure third-party relationships meet Nokia's security expectations and risk tolerance while supporting business objectives. As a trusted security professional, you will evaluate supplier security controls, identify and assess risks, recommend remediation actions, and support ongoing security governance and assurance activities. You will help ensure that third-party security risks are effectively managed throughout the supplier’s lifecycle and that security remains an enabler of business growth and operational resilience. You have: Minimum 4 to 8 years of experience in cybersecurity, information security, risk management, audit, compliance, or third-party risk management. Strong understanding of third-party risk management principles, supplier security assurance, and security governance practices. Experience conducting security assessments, control reviews, or risk evaluations in enterprise environments. Strong understanding of information security controls and common security domains, including access management, vulnerability management, incident management, data protection, and cloud security. Knowledge of security and risk management frameworks such as ISO/IEC 27001, ISO/IEC 27002, ISO 31000, NIST Cybersecurity Framework, CIS Controls, COBIT, and similar industry standards. Ability to analyze security risks and communicate findings clearly to both technical and non-technical stakeholders. Strong analytical, problem-solving, and critical-thinking capabilities. Excellent stakeholder management and collaboration skills. Strong written and verbal communication skills in English. Master's degree in Cybersecurity, Information Technology, Computer Science, Engineering, Risk Management, or related discipline. It Would Be Nice If You Also Had Experience working with supplier security assessment platforms and GRC solutions. Knowledge of cloud security concepts and security assessments of SaaS, PaaS, and IaaS providers. Experience in telecommunications, technology, or large multinational organizations. Knowledge of data protection and privacy requirements affecting third-party engagements. Relevant certifications such as CISSP, CISM, CRISC, ISO 27001 Lead Implementer/Auditor, or equivalent. Experience working in global, matrixed organizations. You Are A trusted security professional with a strong risk-management mindset. Customer-focused and capable of building constructive relationships with internal and external stakeholders. Highly organized, self-motivated, and proactive. Comfortable managing multiple assessments and priorities simultaneously. An effective communicator who can translate technical risks into business-relevant recommendations. A collaborative team player who works effectively across diverse and virtual teams. Focused on delivering practical, sustainable, and risk-based security outcomes.