• Act as a central SPOC for all incoming IT risk assessments and control evidencing requirements adhering the established control framework, SOx requirements and industry best practices;
• Monitoring, tracking and managing deviations to established IT Risk controls;
• Mediating between 1st LOD/2nd LOD and Dev Ops teams;
• Conducting walkthroughs with auditors to review and validate IT Risk control processes;
• Lead technical due diligence sessions with third party vendors.

• Ensure we are in control of our risk appetite;
• Define and document adequate risk processes and collect the evidences in regards; make sure that the different risk parties agree with the evidences;
• Responsible for creating documents and project management requirements or specifications;

• Provide documentation support to the technical team; interface with developers and operation engineers to define the specifications;
• Liaison between the team and other IT Risk professionals;
• Understand the need for security and apply it using the existing framework; constant communication about changes;
• Participate in automation program for process and evidence for IT risk;

• Show proactivity and flexibility, come up with plans of action and adapt approaches if necessary;
• Understand the corporate climate and culture and act as an ambassador; IT custodianship/asset owner role.

• Degree and/or experience in IT risk management, cybersecurity, or related field;
• Understanding of fundamental IT risk and security concepts and ability to think critically across technical control domains;
• Knowledge of IT control frameworks (eg. SOX, GDPR, CSA CCM) and industry standards (eg. ISO2700x, NIST);
• Proven track record of conducting IT control evidencing, qualitative risk assessments and developing mitigation strategies;
• Risk reporting and communication:
• Ability to communicate risk-related concepts to technical stakeholders;
• Experience in liaising with second line risk functions;
• Strong written and verbal communications skills in English;
• Certifications such as CISSP, CISM, CRISC or equivalent are a plus.

• Ability to understand the risck proesses in an IT environment Experience with IT risk standards;
• Ability to make clear and convincing statements related to risk procedures Proven planning and organizing experience.

• Project management experience
• Ability to track, plan and coordinate projects related to third party risk management, technical compliance, and/or IT risk automation;
• Experience in working with Dev(Sec)Ops teams across vulnerability management, threat hunting, security detection and response and developing, or contributing to information security policies and procedures;
• Knowledge of Agile methodology.