Job purpose:

To evaluate the Bank exposure to the ICT and Security risks and to monitor, in cooperation with the relevant functions, the efficacy of the protection measures against ICT resources and to perform related second level controls. (Ref RMD Org Code in force)

Experience and Education:

• Minimum 3 years of experience on IT risks management, cybersecurity, and/or IT audit.
• Bachelor’s and, or master’s degree in computer science, Information Security, or Information Technology.
• Preferable to have strong working knowledge of ISO 2700, NIST CSF, or COBIT.
• Independent oversight capabilities will be considered as an advantage.
• Deep understanding of network architectures, threat landscapes, and security compliance frameworks.
• Familiarity with Cloud Security, Identity and Access Management (IAM), Vulnerability Management, and third-party risk.

Main duties and responsibilities:

• To work closely with the Head of Enterprise, Market & Financial Risk Office with regards to the related activities of ICT and Security 2nd line of defense in compliance with Group’s guidelines and bank’s regulations.
• Design, implement, and periodically update the organization's overarching ICT and Information Security risk policies.
• Ensure internal frameworks comply with regulatory requirements (e.g., DORA compliance) and industry best practices.
• Provide objective, independent oversight of the first line of defense's (IT operations and business units) risk-taking activities.
• Challenge the adequacy of ICT controls (both design and operational execution) to ensure risks stay within the established Risk Appetite Framework.
• Execute periodic, independent risk assessments and vulnerability analyses on IT infrastructure, architecture, and applications.
• Validate that risk mitigation strategies deployed by the first line are effective and reduce residual risk to acceptable levels.
• Define and track Key Risk Indicators (KRIs) related to IT assets and cybersecurity.
• Prepare and present detailed, technical risk dashboards for senior management, the Chief Risk Officer, and Risk Committees.
• Manage the risk acceptance process for any risks falling outside the acceptable tolerance.