ICT Risk Expert (Poland/Remote)

ZEN; Kraków; Remote; PLN 120,000 - 180,000; Full time

Benefits offered by this job

Real influence on shaping ZEN.COM.

Training opportunities (internal and外)

Private medical healthcare.

Internal and external training

Competitive salary and flexible terms

Job summary

ZEN.COM is seeking an ICT Risk Expert to lead ICT risk identification, assessment, and monitoring across our fintech organization. You will work with Cyber Security, IT, Engineering, Operations, Business, and Compliance to ensure risks are identified, documented, and mitigated in line with risk appetite and regulatory requirements.

The role focuses on risk identification, coordination, and monitoring rather than hands-on security controls.

Qualifications

• Experience in ICT risk management and technology risk.
• Experience in fintech, banking, or regulated financial services.
• Strong understanding of IT infrastructure, cloud services, and information security principles.
• Experience conducting ICT risk assessments and translating issues into business risk statements.
• Experience maintaining risk registers and defining mitigation plans.
• Understanding of risk ownership, appetite, and governance structures.
• Ability to challenge stakeholders and manage risks effectively.
• Familiarity with ICT risk management frameworks (ISO 27001, ISO 31000, NIST CSF, COBIT).
• Knowledge of regulatory requirements including DORA in applicable contexts.
• Understanding of third-party ICT risk, business continuity, and resilience.

Responsibilities

• Develop, maintain, and improve the ICT risk management framework and assessment criteria.
• Identify and assess risks related to IT infrastructure, cloud services, and information security.
• Maintain ICT risk register with descriptions, owners, assessments, and dates.
• Define mitigation measures and track remediation activities.
• Support ICT risk indicators, KRIs, and risk reporting for management.
• Coordinate risk acceptance with appropriate decision-makers.
• Assess ICT risks for significant technology changes and new products.
• Monitor risks related to ICT service providers and outsourcing.
• Assess risks concerning business continuity, disaster recovery, and system availability.
• Collaborate with Cyber Security and IT teams to analyze incidents and weaknesses.

Skills

ICT risk management

Regulatory risk

Information security risk

Risk assessment

Third-party risk management

DORA awareness

English proficiency

Job description

ZEN.COM is a smart financial app designed for your everyday life - at home and on the go. We make payments, online shopping, and personal finance management fast, secure, and effortless. With ZEN.COM, you can enjoy cashback on purchases, full control over your spending, and peace of mind thanks to purchase protection. A built-in multi-currency account lets you spend abroad or shop internationally with great exchange rates and no hidden fees.

We are looking for an ICT Risk Expert to support the identification, assessment, monitoring, and management of ICT and technology-related risks across our fintech organization.
The role will focus on establishing a structured and pragmatic approach to ICT risk management, ensuring that technology risks are identified, assessed, documented, and addressed in line with the organization's risk appetite, business objectives, and applicable regulatory requirements.
The successful candidate will work closely with Cyber Security, IT, Engineering, Operations, Business, and Compliance teams to understand technology risks, challenge risk assessments where necessary, and ensure that appropriate mitigation plans are defined and tracked.
This is a specialist risk management role focused on ICT risk identification, assessment, coordination, and monitoring, rather than the hands-on implementation of technical security controls or an independent internal audit function.

Requirements

• Experience in ICT risk management, technology risk, operational risk, information security risk, or a related field.
• Experience in fintech, banking, payments, or another regulated financial services environment.
• Strong understanding of IT infrastructure, cloud services, applications, technology operations, and information security principles.
• Practical experience conducting ICT risk assessments and translating technical issues into clear business risk statements.
• Experience maintaining risk registers, assessing inherent and residual risk, defining mitigation plans, and monitoring remediation.
• Understanding of risk ownership, risk appetite, risk acceptance, escalation processes, and governance structures.
• Ability to challenge technical and business stakeholders constructively and ensure that identified risks are managed appropriately.
• Knowledge of ICT risk management frameworks and standards, such as ISO 27001, ISO 31000, NIST CSF, or COBIT.
• Familiarity with financial services regulatory requirements, particularly DORA and its ICT risk management provisions, where applicable.
• Understanding of third-party ICT risk, business continuity, disaster recovery, and operational resilience.
• Ability to work independently, prioritize competing activities, and operate effectively in a dynamic fintech environment.
• Professional proficiency in English.
• We would appreciate it if you could share your Gallup test or similar assessment results, if available. You can find a dedicated link in the application form on the next page.

Nice to Have

• Experience implementing or improving an ICT risk management framework.
• Familiarity with cloud risk, software development lifecycle risks, technology resilience, and critical service dependencies.
• Relevant certifications such as CRISC, CISA, ISO 27001 Risk Manager, or other risk management qualifications.
• Experience supporting regulatory reviews, risk committees, or supervisory engagements.

Responsibilities

• ICT Risk Management Framework: Develop, maintain, and continuously improve the ICT risk management framework, methodologies, procedures, and assessment criteria.
• Risk Identification and Assessment: Identify and assess risks related to IT infrastructure, applications, cloud services, information security, technology operations, system availability, and third-party dependencies.
• Risk Register Management: Maintain the ICT risk register, ensuring risks have clear descriptions, accountable owners, assessments, mitigation plans, and review dates.
• Risk Mitigation and Treatment: Work with risk owners to define appropriate mitigation measures, track remediation activities, challenge unrealistic timelines, and elevate overdue or insufficient actions.
• Risk Appetite and Reporting: Support the definition and monitoring of ICT risk indicators, thresholds, and key risk indicators (KRIs). Prepare clear risk reports for relevant management stakeholders.
• Risk Acceptance: Coordinate the risk acceptance process, ensuring residual risks are properly assessed, documented, justified, and approved by the appropriate decision-makers.
• Change and Project Risk Assessments: Assess ICT risks associated with significant technology changes, new products, system implementations, migrations, and architectural decisions.
• Third-Party and Outsourcing Risk: Support the assessment and ongoing monitoring of risks associated with ICT service providers, cloud providers, critical suppliers, and outsourced technology services.
• ICT Resilience and Continuity: Assess risks related to business continuity, disaster recovery, system availability, recovery capabilities, and technology dependencies.
• Incident and Problem Risk Analysis: Work with Cyber Security and IT teams to assess the risk implications of major incidents, identify recurring weaknesses, and track risk mitigation actions.
• Regulatory Alignment: Ensure the ICT risk management approach reflects relevant regulatory requirements, including DORA where applicable, and supports the organization's broader enterprise risk management framework.
• Stakeholder Collaboration: Facilitate discussions between technical teams, business stakeholders, and risk functions to ensure technology risks are understood and appropriately managed.
• Continuous Improvement: Identify gaps in risk management practices and improve the quality, consistency, and efficiency of ICT risk assessments and reporting.

What we offer

• Real influence on shaping the ZEN.COM.
• Work in an environment where innovation and effectiveness truly matter.
• Competitive salary and flexible working conditions.
• Private medical healthcare.
• Internal and external training opportunities.