Head of ICT

HANetf, Ltd.; Dublin; On-site; EUR 110,000 - 150,000; Full time

Job summary

HANetf, Ltd. is seeking a senior IT risk and outsourcing governance professional to own the external IT and security landscape.

You will manage MSP relationships, oversee ICT risk frameworks and ensure regulatory compliance under DORA, with close collaboration across Risk, Compliance and senior management. You will coordinate with Engineering on governance of live systems, maintain inventories and incident processes, and provide clear reporting to boards and counterparty bodies.

Qualifications

• Experience in IT operations, governance or vendor management within regulated financial services.
• Working knowledge of DORA and Central Bank of Ireland IT outsourcing expectations or equivalent EU frameworks.
• Hands-on experience running ICT risk frameworks, registers and inventories, and business continuity testing.
• Track record negotiating contracts, managing suppliers and controlling costs.
• Ability to own security and risk accountability without deep technical specialization; escalate risks clearly.
• Experience preparing clear reporting for boards, senior management, auditors and counterparties.
• Ability to work across Engineering, Compliance, Risk, external providers and senior stakeholders.
• Organised, practical approach to documenting decisions and following through on actions.
• Right to work in Ireland and exposure to asset management or funds.
• Professional certification such as CISA, CRISC or CISM and exposure to Cyber Essentials Plus or ISO 27001 programmes.

Responsibilities

• Own outsourced IT and MSP relationships, including contracts, SLAs, escalations and performance reviews.
• Negotiate supplier contracts, challenge costs and manage the budget across outsourced IT and vendor estate.
• Maintain a central register of third-party ICT vendors with ownership, renewal dates and risk classifications.
• Ensure ICT contracts meet DORA requirements with exit strategies for critical functions.
• Run ICT risk management framework and risk register day to day.
• Maintain ICT asset and software inventories and the DORA information register.
• Coordinate ICT incident management including regulatory reporting when required.
• Own business continuity and ICT disaster recovery with recovery objectives and testing.
• Oversee resilience testing and security certification programmes (e.g., penetration testing, ISO 27001).
• Keep IT policies current and support due diligence questionnaires.

Skills

IT governance

Vendor management

DORA knowledge

ICT risk frameworks

Contract negotiation

Security accountability

Board reporting

Cross-functional collaboration

Documentation discipline

Asset management / funds

Job description

Serve as HANetf’s single, named owner for outsourced IT, security and ICT risk, with a reliable view of vendors and risks, and able to show counterparties, auditors, supervisors and boards that issues are identified, escalated and resolved.

The Role

HANetf relies on external providers for much of its IT delivery and specialist security support. The group includes Central Bank of Ireland-authorised entities, including a UCITS management company and a MiFID investment firm, which are subject to the EU Digital Operational Resilience Act (DORA) and the Central Bank’s guidance on IT and cybersecurity risk, outsourcing and operational resilience.

This full-time role makes sure those providers are managed effectively, security and ICT risk responsibilities are clearly defined, and issues are tracked through to resolution. The role manages the outsourced IT and vendor budget and works closely with Risk, Compliance and senior management. It has no direct reports; delivery is through external providers, and the role partners with Engineering on the governance of systems once live.

Key Responsibilities

Outsourced IT and Supplier Management

• Own the managed service provider (MSP) relationship, including contracts, service levels, escalations and performance reviews.
• Negotiate supplier contracts, challenge costs, and manage the budget across the outsourced IT and vendor estate.
• Maintain a central register of all third-party ICT vendors, including those engaged by Engineering. Record ownership, renewal dates and ICT risk classifications, and escalated material risks promptly.
• Make sure ICT third-party contracts meet DORA requirements, with exit strategies in place for providers supporting critical or important functions.

ICT Risk and Regulatory Compliance

• Run the ICT risk management framework and risk register day to day.
• Maintain the ICT asset and software inventories and the DORA register of information.
• Coordinate ICT incident management, including classification and, where required, regulatory reporting of major ICT-related incidents.
• Own business continuity and ICT disaster recovery arrangements, including recovery objectives, backup verification and regular testing.
• Oversee resilience testing and security certification programmes (e.g. penetration testing, Cyber Essentials Plus, ISO 27001).
• Keep the IT policy suite current and under regular review, and support client and counterparty due diligence questionnaires.

Security Governance and Reporting

• Lead day-to-day security governance, including IT and security policies, access controls (joiner, mover and leaver processes and periodic access reviews), incident coordination, and the tracking of corrective actions.
• Engage and manage specialist security partners to provide technical expertise and challenge.
• Provide senior management, the boards of the regulated entities and other governance forums with clear, evidence-based reporting on IT, security and ICT risk.

Candidate Profile

• Experience in IT operations, technology governance or vendor management within regulated financial services.
• Working knowledge of DORA and the Central Bank of Ireland’s IT, outsourcing and operational resilience expectations, or equivalent EU regulatory frameworks.
• Hands-on experience running ICT risk frameworks, registers and inventories, and business continuity testing.
• A track record of negotiating contracts, managing suppliers and controlling costs.
• Confidence in owning security and risk accountability without deep technical specialism: asking effective questions of technical specialists and escalating risks clearly.
• Experience preparing clear reporting for boards, senior management, auditors and counterparties.
• The ability to work effectively across Engineering, Compliance, Risk, external providers and senior stakeholders.
• A practical, organised approach to documenting decisions and following actions through to completion.
• Right to work in Ireland.
• Experience in asset management or funds.
• Relevant professional certification (e.g. CISA, CRISC, CISM).
• Exposure to Cyber Essentials Plus or ISO 27001 certification programmes.