GRC Specialist – IT Risk & Digital Operational Resilience (DORA)

Global Fintech Talent; Amsterdam; On-site; EUR 67,000 - 100,000; Full time

Job summary

Global Fintech Talent is seeking a senior IT risk professional to own DORA and ICT risk for a regulated fintech in the Netherlands. You will build, operate and improve the frameworks, controls and registers to demonstrate effective ICT risk management and DORA compliance.

Reporting to senior management and working with Technology, Risk, Compliance and external providers, you will shape the function, drive risk ownership, and coordinate regulatory readiness and incident responses in a lean,

Qualifications

• 3+ years of experience in IT risk, ICT risk, technology risk, GRC, cyber risk, IT audit or operational resilience.
• Experience in financial services, fintech, or similarly regulated environments.
• Practical experience implementing DORA beyond gap assessments.
• Ability to maintain risk registers, controls and reporting.
• Strong knowledge of third-party ICT risk and outsourcing.

Responsibilities

• Own the ICT risk framework and DORA compliance end to end.
• Develop and operate risk registers, scoring, KRIs and control reporting.
• Translate regulatory requirements into practical controls for tech teams.
• Coordinate DORA readiness, business impact analyses, BIA and DR testing.
• Manage third-party ICT risk, due diligence, onboarding, monitoring and exit planning.
• Lead regulatory reporting and evidence collection for supervisory reviews.

Skills

IT Risk

ICT Risk

Technology Risk

GRC

Cyber Risk

IT Audit

Operational Resilience

Job description

Take ownership of DORA and ICT risk for a growing regulated fintech in the Netherlands, with direct exposure to senior management and the opportunity to shape the framework from the ground up.

This is a rare opportunity to own DORA, ICT risk and operational resilience end to end within a growing regulated fintech.

You will be responsible for building, operating and continuously improving the frameworks, controls, registers and processes required to demonstrate effective ICT risk management and DORA compliance.

Working closely with executive management, Technology, Risk, Compliance and external service providers, you will act as a key internal point of contact for ICT risk and operational resilience. The role offers significant autonomy and the opportunity to influence how the function develops rather than simply maintain an established framework.

What you will own:

• Develop, maintain and operate the ICT risk management framework in line with DORA.
• Own the IT / ICT risk register, including identification, assessment, treatment, acceptance and remediation.
• Maintain risk methodologies, scoring, risk appetite thresholds, KRIs and control effectiveness reporting.
• Translate regulatory requirements into practical controls for technology and operational teams.

DORA and operational resilience:

• Take ownership of the organisation's DORA framework and ongoing compliance.
• Maintain the identification of critical or important functions.
• Coordinate digital operational resilience testing and ensure findings are remediated and evidenced.
• Support Business Impact Analysis, Business Continuity and Disaster Recovery planning and testing.
• Perform periodic reviews of the ICT risk framework and support independent assurance activities.

Third-party ICT risk:

• Own ICT third-party risk across due diligence, onboarding, monitoring, concentration risk and exit planning.
• Assess ICT providers supporting critical or important functions.
• Review contractual requirements and help ensure DORA obligations are reflected appropriately.
• Maintain the Register of Information and support regulatory submissions.
• Coordinate assurance over key ICT service providers and challenge providers where necessary.

ICT incidents and regulatory reporting:

• Maintain the ICT incident classification and escalation framework.
• Coordinate root-cause analysis, remediation and lessons learned.
• Support regulatory assessment and reporting of major ICT-related incidents.
• Maintain the evidence and documentation required for supervisory review.

Governance and regulatory readiness:

• Maintain policies, procedures, controls and supporting evidence.
• Support regulatory information requests, supervisory reviews and inspections.
• Work closely with Risk, Compliance, Legal, Engineering, Security and external providers.

What we are looking for:

You will ideally bring:

• 3+ years of experience in IT Risk, ICT Risk, Technology Risk, GRC, Cyber Risk, IT Audit or Operational Resilience.
• Experience within financial services, payments, fintech, banking, an EMI or another highly regulated environment.
• Practical experience implementing DORA, rather than only conducting gap assessments.
• Experience operating an IT / ICT risk framework and maintaining risk registers and controls.
• Strong knowledge of third-party ICT risk and outsourcing.
• Experience with Business Continuity, Disaster Recovery and operational resilience.
• The ability to work effectively with Engineering, Security and operational teams.
• Confidence communicating with senior management and regulatory stakeholders.
• Professional fluency in English.

Experience working with DNB or another European financial regulator would be particularly valuable.

Dutch language skills are an advantage but not essential.

We would be especially interested in candidates who have personally worked on areas such as:

• DORA implementation
• Register of Information
• ICT third-party risk / TPRM
• DORA Article 30 contractual requirements
• ICT incident classification and reporting
• Operational resilience testing
• BIA, BCP and Disaster Recovery
• Risk appetite, KRIs and control frameworks
• DNB information requests or supervisory interaction
• ISO 27001, NIST, COBIT, CISA, CISM, CRISC or CISSP

The environment: This is a senior individual-contributor role.

It will suit someone who enjoys ownership and is comfortable moving between strategic regulatory requirements and detailed execution. You should enjoy building and improving frameworks yourself rather than relying on a large team around you.

The organisation operates with a relatively lean structure, so the ability to take initiative, work through ambiguity and collaborate directly with senior decision-makers will be important.

Compensation: €6,000–€9,000 gross per month, depending on experience, with some flexibility for exceptional candidates. Applicants must already be based in the Netherlands or be able to work from the Netherlands.

All conversations will be treated confidentially.