IT OpsRisk Engineer

About the role

ING Hubs Romania, which provides software development, data management, risk and compliance, audit and retail operations services to 24 ING units worldwide, is looking for an IT OpsRisk Engineer in its Financial Markets domain. You will help implement and prove IT controls, work in an agile environment with DevOps squads and act as a central point of contact for IT risk assessments.

Key responsibilities

• Act as central SPOC for incoming IT risk assessments and control-evidence requirements, following the control framework, SOX requirements and industry best practice
• Monitor, track and manage deviations from established IT risk controls
• Mediate between first and second line of defence and DevOps teams
• Conduct walkthroughs with auditors to review and validate IT risk control processes
• Lead technical due diligence sessions with third-party vendors
• Help squads implement IT controls and collect evidence that they are effective
• Define and document risk processes, create project management requirements and specifications, and support the technical team
• Liaise with developers and operations engineers, other IT risk professionals and second-line risk functions
• Apply security within the existing framework, take part in the automation programme for IT risk processes and evidence, and act as an IT custodian

Required profile

• Degree and/or experience in IT risk management, cybersecurity or a related field
• Understanding of fundamental IT risk and security concepts and critical thinking across technical control domains
• Proven track record of IT control evidencing, qualitative risk assessments and mitigation strategies
• Strong written and verbal English; advanced English is a plus
• Nice to have: bachelor's degree in an IT-related field, project management experience, knowledge of Agile, and experience with DevSecOps teams

Required skills

• IT control frameworks such as SOX, GDPR, CSA CCM
• Standards such as ISO 2700x and NIST
• Certifications such as CISSP, CISM, CRISC or equivalent are a plus