IT Risk Manager (m/f/d) Banking

About the Company: A leading global financial institution with a strong presence in Europe, committed to maintaining robust technology and cyber risk management practices. The organization operates within a complex regulatory environment and is dedicated to ensuring compliance with evolving EU standards, including DORA and ICT risk requirements. Role Overview: The IT Risk Manager (AVP) plays a critical First Line of Defence role, responsible for identifying, assessing, managing, and remediating technology and cyber risks across the organization’s European operations. This position ensures that risks are effectively managed in line with internal frameworks and EU regulatory expectations while embedding governance and reporting practices into day-to-day Technology and Cyber activities. The role also supports regional initiatives across EMEA, driving alignment with broader frameworks and standards. Additionally, the IT Risk Manager coordinates regulatory responses and audit engagements to ensure compliance with obligations across Germany, France, Belgium, and other jurisdictions.

Key Responsibilities:

• Risk Ownership & Management:

  • Own the identification, assessment, and management of IT and cyber risks across European operations.
  • Maintain an accurate risk profile and actively manage remediation efforts to address control gaps.
  • Embed risk management practices within Technology and Cyber teams as part of daily operations.

• Control Framework Design & Operation:

  • Design, implement, and operate technology and cyber controls aligned with organizational standards.
  • Ensure controls are effective, documented, tested, and traceable to risks, issues, and remediation actions.

• Regulatory Compliance & DORA Implementation:

  • Coordinate responses to EU regulators (e.g., ECB, EBA) on IT and cyber risk topics.
  • Ensure compliance with local regulatory requirements across Germany, France, Belgium, etc.
  • Support the interpretation and implementation of DORA requirements into practical controls.

• Audit & Issue Management:

  • Manage responses to internal/external audits impacting European operations.
  • Define remediation plans for audit findings and ensure sustainable closure of issues.

• Governance & Reporting:

  • Operate IT and cyber risk governance forums across European entities.
  • Produce regular risk reports for senior management detailing exposure, control effectiveness, and progress on remediation efforts.

• Regulatory Engagement:

  • Act as a key point of contact for regulatory interactions across European jurisdictions (e.g., ECB, BaFin).
  • Coordinate supervisory requests, onsite reviews, and ensure consistency in regulatory responses.

• Regional Alignment:

  • Support broader EMEA technology/cyber risk initiatives by contributing to regional frameworks and sharing insights across entities.

Required Skills & Experience:

• Strong experience in IT risk or cyber risk management within a First Line of Defence role.
• Proven ability to own/manage risks and controls within Technology or Cyber functions.
• Solid understanding of EU regulatory requirements (e.g., ECB, EBA) and local supervisory bodies (e.g., BaFin).
• Practical knowledge of DORA implementation and ICT risk management frameworks.
• Experience managing regulatory interactions/audit responses in complex environments.
• Strong stakeholder engagement skills with the ability to influence cross-functional teams.

Challenges of the Role:

This position requires balancing strong ownership of risks within the First Line of Defence while ensuring alignment with Group standards set by Second Line functions. Key challenges include:

• Navigating a complex regulatory landscape involving multiple supervisory bodies across Europe (ECB, EBA, BaFin).
• Embedding consistent risk management practices into dynamic Technology/Cyber teams while addressing competing priorities.
• Managing concurrent regulatory requests, audits, and remediation activities while meeting delivery timelines.
• Interpreting evolving regulations like DORA into practical controls that align with organizational goals.