Head of Department - ICT and Security Risk Management

Tasks

• Build ICT and security risk strategy and roadmap
• Build insight led risk dashboards
• Conduct thematic deep dives for technology risks
• Coordinate with BCM and data protection for resilience and compliance
• Coordinate with internal audit and compliance to map findings
• Define risk appetite and risk limits
• Deliver risk reporting to senior management and committees
• Establish 2nd line risk function with RACI and engagement standards
• Manage risk acceptance evaluation for NFR decisions
• Oversee enterprise ICT risk assessments
• Own and improve ICT and security risk framework
• Partner with DevSecOps leadership to reduce control drift
• Provide oversight for security outsourcing third party data privacy and IT resilience risks
• Provide second line challenge on technology decisions
• Run governance routines and drive actionable outcomes
• Set ICT and security risk governance standards
• Set KRI and KPI thresholds
• Train first line teams with playbooks and assessment templates

Perks/Benefits

• Birthday day off
• Bookster subscription
• Flexible benefits budget
• Flexible work schedule
• Gifts for special occasions
• Hybrid work
• Insurance discounts
• Performance-based bonus
• Private medical services
• Private pension
• Professional development programs
• Vacation days
• Wellbeing programs

Skills/Tech-stack

Business Continuity | Business Continuity Management | COBIT | Change Management | Cloud Risk Management | Cloud risk | Continuity management | Control Assessment | Cyber Risk | DORA | Dashboarding | Data Privacy | DevSecOps | Enterprise Risk | Enterprise Risk Assessment | Governance | Governance Escalation | ICT RISK | ICT Risk Framework | ISO 27001 | IT resilience | ITIL | Information security | Key Risk Indicators | NIST | Operational Resilience | Outsourcing Risk Management | Policy Management | Risk Assessment | Risk Limits | Risk Management | Risk appetite | Risk framework | Risk indicators | Security Governance | Third-Party Risk | Third-party risk management