Bucuresti ICT and Security Risk Manager

Localitate: Bucuresti Durata Contract: Nedeterminat Domeniu: Managementul Riscului About our team BCR is the place where you learn, grow, and contribute to shaping the future of banking. We are recognized as a school of excellence in banking, a top employer in the banking sector, and a team open to learning, where every colleague feels noticed and valued. We are an organization that values people and supports them in having a life that brings fulfillment, security, and balance. Your Role As a ICT & Security Risk Manager, you’ll drive the execution of the ICT risk management framework, provide constructive challenge to Technology & Security teams, and ensure risks are monitored and reported effectively to support secure, resilient operations. How you will contribute Maintain and enhance the ICT & Security Risk Policy, procedures, and assessment methodology, ensuring alignment with DORA and internal governance standards; Execute and coordinate enterprise-wide ICT risk assessments and targeted thematic reviews; Assess security findings and control weaknesses, validate risk severity, and ensure structured, risk-based remediation tracking; Provide effective 2nd line challenge to 1st line risk assessments, delivering pragmatic and actionable recommendations; Own and improve the ICT/Cyber risk register, ensuring accuracy, completeness, and audit readiness; Monitor risk treatment plans and mitigation effectiveness, escalating overdue or high-impact risks where necessary; Support NFR/Risk Acceptance governance, ensuring risk acceptances are properly justified, time-bound, and approved according to delegation rules; Build and maintain a meaningful KRI framework and deliver clear management-ready dashboards; Analyze trends across incidents, downtime, vulnerabilities, audit findings for forward-looking risk insights; Contribute to severe-but-plausible scenario analysis and resilience assessments, providing quantified impact assumptions and identifying control weaknesses; Lead the ICT change risk component by assessing high-risk changes, monitoring change-related KRIs, and challenging CAB/ECAB processes, post-implementation reviews, and rollback readiness – in collaboration with Technology, Security, Internal Audit, and Compliance. What will help you be successful 4+ years of experience in ICT/cyber risk, tech audit/controls, security governance, or operational risk with strong IT exposure; Hands-on experience performing risk assessments, control evaluation, and preparing management-level risk reporting; Good understanding of regulatory expectations and industry best practices (DORA, NIST CSF, ISO 27001/27002, COBIT, ITIL); Strong analytical mindset and the ability to translate technical vulnerabilities into clear business risk implications; Confidence to act as a constructive challenger when working with senior technical stakeholders; High standards for documentation and evidence-based writing, delivering audit-ready outputs; Comfortable working with KRIs, thresholds, and trend analysis; Integrity, independence, and sound professional judgment in risk-based decision making; Certifications such as CISM, CISSP, CRISC, CISA, ISO 27001 LA/LI, ITIL, COBIT are an advantage; Exposure to third-party ICT risk, cloud risk governance, scenario analysis or operational resilience exercises is considered a plus. Sounds like you'd be a good fit? Well, check out what we provide for our passionate people Monthly budget for flexible benefits through the Benefit Online platform; Performance-based bonus; Banking facilities, benefits for private pension and discounts on insurance policies; Gifts for special occasions; Private medical services for you and your family; Hybrid and flexible work schedule; Up to 27 vacation days depending on your professional experience; Extra 7 days off per year if you have used up your vacation days; One day off for your birthday; Wellbeing, personal and professional development programs, and platforms that allow you to learn anytime, anywhere, and from any device; Subscription to Bookster.