IT OpsRisk Engineer

About the role

ING Hubs Romania, which provides software development, data management, risk and compliance, audit and retail operations services to 24 ING units worldwide, is looking for an IT OpsRisk Engineer in its Financial Markets domain. You will help squads implement IT controls and prove they are effective, working in an agile environment with DevOps squads.

Key responsibilities

• Act as the central point of contact for incoming IT risk assessments and control-evidence requirements, following the control framework, SOX requirements and industry best practice.
• Monitor, track and manage deviations from established IT risk controls.
• Mediate between first and second line of defence and DevOps teams.
• Conduct walkthroughs with auditors to review and validate IT risk control processes.
• Lead technical due diligence sessions with third-party vendors.
• Help squads implement IT controls, define and document risk processes, collect evidence and ensure risk parties agree on it.
• Create documents and project management requirements, support the technical team and liaise with developers and operations engineers.
• Apply security within the existing framework, communicate changes and take part in the automation programme for IT risk processes and evidence.

Required profile

• Degree and/or experience in IT risk management, cybersecurity or a related field.
• Understanding of fundamental IT risk and security concepts and critical thinking across technical control domains.
• Proven track record of IT control evidencing, qualitative risk assessments and mitigation strategies.
• Strong written and verbal English; advanced English is a plus.
• Nice to have: bachelor's degree in an IT field, project management experience, knowledge of Agile, and experience with DevSecOps teams.

Required skills

• Knowledge of IT control frameworks such as SOX, GDPR and CSA CCM, and standards such as ISO 2700x and NIST.
• Certifications such as CISSP, CISM or CRISC are a plus.
• Ability to communicate risk concepts to technical stakeholders and liaise with second-line risk functions.