Cyber Risk and TPRM Specialist

Purpose

The Cyber Risk and TPRM Specialist will be placed in the Cybersecurity and Information Security Business Area and contribute to the core volume of Cyber Security Services. As a Cyber Risk and Compliance TPRM Specialist, you will primarily be assisting the oversight and evaluation of risks associated with third-party vendors or service providers. You will work closely with Senior team members, ensuring that external relationships adhere to regulatory requirements and organizational standards for risk, compliance, security, and resilience.

What you will be doing

•    Collaborate with the Bank’s second and third lines of defense, participating in Cyber Risk Assessment activities to identify, assess, and manage ICT risks, and to develop, maintain, and monitor appropriate controls, including the definition and monitoring of KRIs.
•    Apply Cyber Risk Management processes in line with regulatory requirements and industry best practices, identifying potential compliance risks and vulnerabilities, coordinating mitigation plans, and monitoring the implementation of related actions.
•    Support the Supervisory Review and Evaluation Process for ICT risks and contribute to supervisory dialogue with BoG, JTS, SSM, and ECB, while supporting the development and maintenance of a formal IT risk and control compliance program.
•    Coordinate ICT third-party risk assurance across the first line, supporting the DORA Register of Information, pre-contractual due diligence and criticality assessments for ICT service providers supporting critical or important functions, and monitoring contractual, subcontracting, and exit-strategy requirements throughout the lifecycle.
•    Oversee ongoing assurance over material ICT outsourcing arrangements, including concentration-risk monitoring, review of third-party control attestations (e.g. SOC 2, ISAE 3402) and audit/pooled-audit rights, and tracking remediation of third-party findings in line with DORA, the EBA Guidelines on outsourcing, and relevant BoG Acts.

What you need to have

•    A Bachelor’s degree in Information Technology, Computer Science, Statistics, or another relevant technical-oriented field.
•    A Master’s degree in the above fields, or in Finance, Business Administration, or Management, will be considered a plus.
•    A relevant professional certification (e.g. CISA, CRISC, or CISM) will be considered a strong asset.
•    Understanding of banking processes, IT systems, and IT service workflows, supporting IT governance activities.
•    Knowledge of IT risk management procedures and protocols, including the development of IT risk control and response activities.
•    Familiarity with financial services regulations and banking supervision, such as DORA, EBA Guidelines on ICT and security risk management, ICT risk assessment under the Supervisory Review and Evaluation, and relevant BoG Acts.
•    Proven experience in Cyber regulatory compliance within the Banking / Financial Services sector.
•    Ability to build effective relationships with stakeholders, external partners, auditors, and supervisory authorities.
•    Strong organizational, presentation, and project management skills.