Head of ICT and Security Risk Management Department – CDI

Jobs; Palo Alto (CA); On-site; USD 202,000 - 291,000; Full time

Job summary

Nomura Bank Luxembourg S.A. is seeking a Head of ICT and Security Risk Management to lead the bank's digital operational resilience program and ensure full compliance with the DORA and related regulatory expectations.

You will establish and govern an end-to-end ICT risk framework, manage risk policy, oversee testing programs including vulnerability assessments, and provide executive reporting on risk appetite and KRIs.

Qualifications

• Experience in information security and ICT risk management.
• Knowledge of ICT risk management methodologies and cybersecurity standards.
• Certifications such as CISM, CRISC, CISSP or CISA are desirable.

Responsibilities

• Lead ICT risk management framework and digital operational resilience strategy.
• Provide expert advisory and regular reporting to Executive Committee and Board.
• Develop, maintain ICT risk policies, procedures and governance structures.
• Oversee Digital Operational Resilience testing, vulnerability management, and TP testing.
• Lead and manage ICT and Security Risk Management team.

Skills

Information security

ICT risk management

Cybersecurity frameworks

DORA / ISO27001 / NIST

Threat intelligence

Risk reporting

Team leadership

Regulatory awareness

Education

Bachelor’s degree in Computer Science / IT / Information Security

Tools

SIEM

DLP

Endpoint protection

Threat intelligence platforms

Job description

Head of ICT and Security Risk Management Department – CDI

The Risk Management Department is responsible for the risk control function of the Bank, encompassing both Financial Risk and Operational Risk matters.

The Risk Management Department monitors existing and emerging risks, assess them and report them to the Senior Management of the Bank. It supports the business in managing their risks, providing guidance to promote risk awareness continuously.

We are seeking an experienced Head of ICT & Security Risk Management on a permanent role to lead our digital operational resilience strategy and ensure full compliance with the EU Digital Operational Resilience Act (DORA) and relevant regulatory requirements.

Your main tasks will be to:

• Be responsible for establishing and maintaining and governing a comprehensive ICT risk management framework
• Protect the Bank against cyber threats, operational disruptions, and third-party risks while enabling business growth and innovation.
• Manage and enhance the Bank's ICT risk management strategy and digital operational resilience framework in compliance with DORA regulations;
• Provide expert advisory and regular reporting to the Executive Committee and the Board of Directors on ICT Risk appetite, tolerance levels, and evolving regulatory expectations;
• Develop, maintain and enforce comprehensive ICT risk policies, procedures, and governance structures across the organization;
• Conduct and manage the Digital Operational Resilience testing program, including vulnerability management, and Threat-Led Penetration Testing and comprehensive ICT risk assessments covering all systems, applications, and third-party services whenever applicable;
• Implement continuous monitoring and threat intelligence programs to identify emerging risks;
• Develop and maintain Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) for ICT risk management purpose;
• Foster collaboration across IT, Risk, Compliance, and operating units;
• Provide training and awareness programs to enhance ICT risk culture across the organization.
• Lead and manage the ICT and Security Risk Management team, while supervising the department's objectives and operational alignment.

Job requirements:

• Relevant experience in information security and ICT risk management;
• Educational background in Computer Science, IT or Information Security
• Professional certifications such as CISM, CRISC, CISSP, or CISA are highly desirable.
• Comprehensive knowledge of ICT risk management methodologies and frameworks as well as cybersecurity frameworks, industry standards and regulations (e.g. ISO27001, NIST, DORA);
• Knowledge of cybersecurity technologies including SIEM, DLP, endpoint protection, and threat intelligence;
• Proactively support business and IT teams for assessing security and ICT Risk;
• Participate in ICT and security projects;
• Adopting a growth mind-set, promoting a culture of security;
• Excellent team player with proactive and autonomous work ethics;
• Strong analytical skills with attention to details;
• Awareness of professional ethics, risk and compliance;

Please be aware that in accordance with the law of July 23, 2016, the selected candidate will be requested to provide a criminal record (section 3)

Company Nomura Bank Luxembourg S.A. Address Bâtiment A33, rue de GasperichL-5826 Hesperange, Luxembourg, Luxembourg Website: www.nomura.com/luxembourg

Company Profile: Nomura Group stands as one of the leading financial services organizations with a worldwide presence.As a strategic hub within the Group, Nomura Bank (Luxembourg) S.A. specializes in comprehensiv... Read Full Profile