Head of ICT Risk & InfoSec Governance (DORA)

LemFi; Dublin; Hybrid; EUR 140,000 - 190,000; Full time

Job summary

LemFi in Dublin, Ireland is seeking a Head of InfoSec & ICT Risk Europe to own the ICT risk control function and the DORA framework across the region. You will shape policies, evidence, and resilience with a focus on automation and continuous monitoring.

Based in Dublin with one day a week in the office, reporting to the CTO, you will partner with engineering and the business to align security with regulatory expectations, manage third-party risk, and drive incident classification and

Qualifications

• Owned information security or ICT risk governance at a regulated financial firm.
• Deep experience with DORA and Irish Central Bank expectations.
• Built or improved ISMS aligned to ISO 27001.
• Experience with GRC automation platforms like Vanta or Drata.
• Strong ability to translate regulatory requirements into controls.

Responsibilities

• Own the DORA ICT risk management framework end to end: policies, risk appetite, control library and annual board review.
• Act as independent ICT risk control function, challenging engineering and business.
• Be Central Bank of Ireland's point of contact on information security and resilience.
• Run ICT incident classification and reporting within DORA timelines with root-cause analysis.
• Own ICT third-party risk: due diligence, contract terms, exit plans.
• Run digital operational resilience testing from scoping to closure.
• Automate compliance by integrating GRC tooling with cloud/identity/ticketing systems.
• Own information security policy, awareness training and the ISMS (ISO 27001).
• Turn security posture into board/regulator reporting and risk indicators.
• Partner with security engineers to translate regulatory requirements into testable controls.

Skills

ICT risk governance

DORA knowledge

ISO 27001 ISMS

GRC automation

Cloud security awareness

Tools

Vanta

Drata

Job description

LemFi in Dublin, Ireland is seeking a Head of InfoSec & ICT Risk Europe to own the ICT risk control function and the DORA framework across the region. You will shape policies, evidence, and resilience with a focus on automation and continuous monitoring.

Based in Dublin with one day a week in the office, reporting to the CTO, you will partner with engineering and the business to align security with regulatory expectations, manage third-party risk, and drive incident classification and