Head of ICT and Security Risk Management Department - CDI - Luxembourg

The Risk Management Department is responsible for the risk control function of the Bank, encompassing both Financial Risk and Operational Risk matters. The Risk Management Department monitors existing and emerging risks, assess them and report them to the Senior Management of the Bank. It supports the business in managing their risks, providing guidance to promote risk awareness continuously. We are seeking an experienced Head of ICT & Security Risk Management on a permanent role to lead our digital operational resilience strategy and ensure full compliance with the EU Digital Operational Resilience Act (DORA) and relevant regulatory requirements. Your main tasks will be to: Be responsible for establishing and maintaining and governing a comprehensive ICT risk management framework Protect the Bank against cyber threats, operational disruptions, and third-party risks while enabling business growth and innovation. Manage and enhance the Bank's ICT risk management strategy and digital operational resilience framework in compliance with DORA regulations; Provide expert advisory and regular reporting to the Executive Committee and the Board of Directors on ICT Risk appetite, tolerance levels, and evolving regulatory expectations; Develop, maintain and enforce comprehensive ICT risk policies, procedures, and governance structures across the organization; Conduct and manage the Digital Operational Resilience testing program, including vulnerability management, and Threat-Led Penetration Testing and comprehensive ICT risk assessments covering all systems, applications, and third-party services whenever applicable; Implement continuous monitoring and threat intelligence programs to identify emerging risks; Develop and maintain Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) for ICT risk management purpose; Foster collaboration across IT, Risk, Compliance, and operating units; Provide training and awareness programs to enhance ICT risk culture across the organization. Lead and manage the ICT and Security Risk Management team, while supervising the department's objectives and operational alignment. Job requirements: Relevant experience in information security and ICT risk management; Educational background in Computer Science, IT or Information Security Professional certifications such as CISM, CRISC, CISSP, or CISA are highly desirable. Comprehensive knowledge of ICT risk management methodologies and frameworks as well as cybersecurity frameworks, industry standards and regulations (e.g. ISO27001, NIST, DORA); Knowledge of cybersecurity technologies including SIEM, DLP, endpoint protection, and threat intelligence; Proactively support business and IT teams for assessing security and ICT Risk; Participate in ICT and security projects; Adopting a growth mind-set, promoting a culture of security; Excellent team player with proactive and autonomous work ethics; Strong analytical skills with attention to details; Awareness of professional ethic...

JBLE1_LU