02/18/2026 updated
100 % available
IT Ops Risk Engineer - Google Cloud Platform
Bucharest, Romania
Worldwide
Controles de AccesoBusiness ContinuityBusiness Continuity PlanningCloud ComputingComputer SecurityDisaster RecoveryIncident ResponseIdentity ManagementIT Risk ManagementInformation Security ManagementISO/IEC 27001Risk AnalysisVulnerabilityVulnerability ManagementCarry Out Assessments
Information Security Standards
Expertise in ISO 27001, ISO 27002, and NIST 800-53 standards for information security management and risk assessment.
IT Risk Management
Proficient in identifying, assessing, and mitigating IT risks, particularly in cloud environments like Google Cloud Platform.
Business Continuity Management
Skilled in developing and implementing IT and business continuity plans, ensuring operational resilience and disaster recovery readiness.
Identity and Access Management (IAM)
Experience in designing and implementing access control matrices, conducting reviews, and managing user permissions and roles.
Vulnerability Management
Proficiency in identifying, reporting, and tracking vulnerabilities using tools like Google Security Command Center (GSCC).
Compliance and Regulatory Standards
Knowledge of various compliance frameworks including CIS, NIST, ISO, and industry-specific regulations.
Security Monitoring and Incident Response
Capability in conducting ongoing security monitoring, threat assessments, and managing security incidents.
Expertise in ISO 27001, ISO 27002, and NIST 800-53 standards for information security management and risk assessment.
IT Risk Management
Proficient in identifying, assessing, and mitigating IT risks, particularly in cloud environments like Google Cloud Platform.
Business Continuity Management
Skilled in developing and implementing IT and business continuity plans, ensuring operational resilience and disaster recovery readiness.
Identity and Access Management (IAM)
Experience in designing and implementing access control matrices, conducting reviews, and managing user permissions and roles.
Vulnerability Management
Proficiency in identifying, reporting, and tracking vulnerabilities using tools like Google Security Command Center (GSCC).
Compliance and Regulatory Standards
Knowledge of various compliance frameworks including CIS, NIST, ISO, and industry-specific regulations.
Security Monitoring and Incident Response
Capability in conducting ongoing security monitoring, threat assessments, and managing security incidents.
Experience
Professional experience0 - 5 years
Freelancer since2024
Languages
EnglishFluentRomanianNative speaker
Project history
General Responsibilities:
-Managed – identified, assessed, mitigated – Risk in Google Cloud Platform at application level.
-Performed ICT Controls
-Developed and tracked Action Plans for risk mitigation and adherence.
-Mitigated and Documented audit findings.
-Stakeholder Management: Business Heads, IT Asset Owners, Product Owners, Engineering Team, Compliance Team, Auditors and Vendors.
IT Risk Management:
-Conducted IT Risk and Control Self-Assessment (RCSA), identifying key risks and controls.
-Performed Risk Assessments
-Monitored and documented the scope and effectiveness of security controls (e.g. patching, vulnerability management, lifecycle management, technical state compliance monitoring, penetration testing, change management, etc.)
Continuity and IT Governance:
-Led Business Impact Analysis (BIA)
-Defined and implemented Disaster Recovery documentation.
-Negotiated security requirements in report to business needs.
Security Monitoring and Detection:
-Led Vulnerability Management using Google Security Command Center (GSCC).
-Utilized Security Health Analytics to detect and track misconfigurations in GCP
-Correal-time threats with risk exposure and mitigation strategies (Threat Modelling)
IAM:
-Manually designed and documented the Access Rights Cartography (personal and non-personal accounts NPA )
-Identified and remediated Toxic Combinations - segregation of duties
-Conducted cryptographic key rotation for NPAs
Supported the Information Security Program, collaborated with stakeholders, updated contractual clauses related to IT Risk and Cybersecurity, and acted as a Single Point of Contact for IT Risk and Cybersecurity matters.
Governance, Compliance and Regulatory tasks:
- Updated and created procedures, policies, and work instructions related to IT Risk and Cybersecurity processes
- Colaborated with Legal Team in updating contractual clauses related to IT Security topics
- Acted as the Single Point of Contact (SPOC) between the IT Risk and Cybersecurity team, Business Owners, ITAO, Vendors,
- Created relevant communications to ensure a strong and healthy Cybersecurity culture.
- Partook in the sustained efforts of increasing the NIST score.
Business Continuity:
- Assisted in the creation and validation of the Business Continuity Analysis, providing input and support to business owners to facilitate a smooth process.
IT Risk Management:
-Identified, assesed, documented and created mitigation plans related to IT Risk
- Updated the Risk Register.
- Performed and documented quarterly ICT
- Completed Due Diligence documents.
Other actions:
- Gathered evidence and held interviews for Audit.
- Negociated Audit Recommendations.
- Reported Audit Progress
Incident Management:
- Identified, investigated and reported potential DLP incidents legeraging Symanted DLP
- Classified incident severity
Data Loss Prevention:
- Reviewed and reported Symantec flagged events
- Deployed DLP exceptions
Governance, Compliance and Regulatory tasks:
- Updated and created procedures, policies, and work instructions related to IT Risk and Cybersecurity processes
- Colaborated with Legal Team in updating contractual clauses related to IT Security topics
- Acted as the Single Point of Contact (SPOC) between the IT Risk and Cybersecurity team, Business Owners, ITAO, Vendors,
- Created relevant communications to ensure a strong and healthy Cybersecurity culture.
- Partook in the sustained efforts of increasing the NIST score.
Business Continuity:
- Assisted in the creation and validation of the Business Continuity Analysis, providing input and support to business owners to facilitate a smooth process.
IT Risk Management:
-Identified, assesed, documented and created mitigation plans related to IT Risk
- Updated the Risk Register.
- Performed and documented quarterly ICT
- Completed Due Diligence documents.
Other actions:
- Gathered evidence and held interviews for Audit.
- Negociated Audit Recommendations.
- Reported Audit Progress
Incident Management:
- Identified, investigated and reported potential DLP incidents legeraging Symanted DLP
- Classified incident severity
Data Loss Prevention:
- Reviewed and reported Symantec flagged events
- Deployed DLP exceptions