IT & Operational Risk H/F

Reporting to the CIO, theIT Risk Owner (ITRO) is a first line of defense role responsible for managing ICT risk within its scope, covering governance, operations and incidents, projects and application development, suppliers, obsolescence and compliance. The ITRO helps consolidate the overall ICT risk view and coordinates with the relevant stakeholders to ensure comprehensive risk coverage.

Responsibilities

• Contribute to the definition of the entity’s ICT risk appetite and Digital Operational Resilience Strategy (DORS).
• Help design, maintain and improve the ICT risk management framework, in coordination with other risk stakeholders.
• Identify, assess and monitor ICT risks within the scope of responsibility, and escalated cross‑cutting risks where needed.
• Lead and track remediation actions and the ICT risk action plan.
• Define and monitor KPIs/KRIs, produce dashboards and support risk reporting to governance bodies.
• Monitor developments in the internal and external environment, including regulations, standards, technologies and emerging risks.
• Contribute to Group-level assessment and control campaigns and governance activities.
• Ensure ICT risk is properly addressed in projects, whether internal or outsourced.
• Advise the CIO, project managers, business lines and functions on ICT risk matters.
• Raise awareness and provide training on ICT risk across the entity.
• Coordinate the maintenance of reference architectures, asset mapping and dependencies, including third‑party relationships.
• Contribute to the management of ICT incidents and crises, in cooperation with the relevant stakeholders.
• Define and run the Level 2.1 control plan, and ensure Level 1 controls are performed.
• Support internal control reporting and periodic reviews of the ICT risk management framework.
• Assess third parties used by the entity and ensure DORA compliance.
• Support the entity in its due diligence and DORA compliance towards external clients.