Remote ICT Risk & Resilience Lead | DORA Expert

Neema - Better Than a Bank; Netherlands (MO); Hybrid; USD 90,000 - 130,000; Full time

Job summary

A digital financial services provider is seeking an ICT Risk & Resilience Lead to ensure operational resilience and compliance with local regulations. The role involves managing the DORA framework, performing audits, and overseeing third-party risks. Candidates should have over 5 years of relevant experience in IT risk or cybersecurity, with strong knowledge of DORA and GDPR. Fluency in English is required, and proficiency in Dutch is preferred. This position offers remote or hybrid work options.

Qualifications

• 5+ years of experience in IT Risk, Cybersecurity, or IT Audit.
• Deep knowledge of DORA and GDPR regulations.
• Fluent in English; Dutch proficiency preferred.

Responsibilities

• Own the DORA framework and execute technical requirements.
• Perform monthly spot checks on security configurations.
• Lead oversight of third-party risk management.

Skills

IT Risk Management

Cybersecurity

Regulatory Knowledge

Cloud Computing

Incident Management

Data Privacy

Education

Relevant certifications (CISA, CRISC, etc.)

Tools

AWS

Azure

Vulnerability scanners

GRC automation tools

Job description

Location: Netherlands (Remote / Hybrid) Reports to: CEO and Management

Committee Collaborates with: CISO, CCO, and Engineering

Our Mission

Neema is built on global impact- providing digital financial services to tens of thousands of users worldwide, regardless of traditional banking status. As our ICT Risk & Resilience Lead, you won't just write policies; you will be the primary owner of our Digital Operational Resilience Act (DORA) framework, ensuring our infrastructure is fundamentally resilient and audit-ready every single day.

The Role: Practitioner, Not Just a Policy Writer

This is a high-execution role for someone who is as comfortable in a SIEM console as they are in a regulatory meeting. You will bridge the gap between technical IT operations and Dutch regulatory requirements (DNB/AFM).

Key Responsibilities

• DORA Framework Ownership: Execute the technical requirements of the Digital Operational Resilience Act, maintaining the ICT risk management framework and the DORA Register of Information (RoI).
• Technical Evidence & Deep-Dives: Directly access IT and security systems (Azure/AWS, CrowdStrike, SIEM) to extract evidence of control effectiveness.
• Continuous Monitoring: Perform monthly "spot checks" on user access reviews, firewall configurations, and encryption standards.
• Third-Party Risk (TPRM): Lead oversight of ICT third-party providers (Cloud, Payment infrastructure), ensuring contracts meet DORA standards and conducting periodic audits.
• Incident & Resilience Management: Classify and log ICT incidents for regulatory reporting and coordinate annual resilience testing (vulnerability assessments and network reviews).
• Audit Defense: Act as the primary point of contact for external auditors and regulators, organizing the "Audit Room" and explaining technical control implementations.
• Data Mapping & Privacy: Maintain GDPR Article 30 ROPA and conduct hands-on Privacy Impact Assessments (DPIAs) for new software or vendors.

Required Skills & Qualifications

• Experience: 5+ years in IT Risk, Cybersecurity, or IT Audit within Fintech or Banking (EMI/PI preferred).
• Regulatory Fluency: Deep, practical knowledge of DORA and GDPR. Familiarity with NIS2, PSD2, and EU AI Acts is required.
• Technical Proficiency: Comfortable navigating Cloud environments (AWS/Azure), IAM tools, and vulnerability scanners.
• Tooling: Experience with GRC automation tools (e.g., Vanta, Drata, or Secureframe).
• Certifications: CISA, CRISC, CISM, or CISSP.
• Communication: Fluent English is mandatory. Dutch proficiency is highly preferred for nuanced communication with local stakeholders and regulators.