IT and IS Risk Senior Specialist

About the role

The Senior IT & IS Risk Specialist supports the Group’s information security and IT risk management across the Corporate Center and Strategic Assets. The role shapes risk strategies, monitors emerging cyber threats, and ensures consistent risk practices throughout the organization.

Key responsibilities

• Define and maintain the Group‑wide IT and Information Security risk management framework, baselines and methodologies.
• Drive implementation of cyber‑resilience targets, coordinate maturity assessments and track improvement initiatives.
• Maintain and report key risk indicators, consolidate quarterly risk reports and escalate material risks.
• Develop and enforce security policies, standards and procedures, and monitor compliance across the organization.
• Oversee data security monitoring, identity and access management controls, and third‑party cyber risk programs.
• Lead incident response planning, investigations and post‑incident analysis.

Required profile

• Senior‑level experience in IT/Information Security risk management, preferably within a large, multi‑entity organization.
• Strong knowledge of ISO 27001, NIST Cybersecurity Framework and related regulatory requirements.
• Proven ability to work with cross‑functional stakeholders and influence risk‑related decisions.

Required skills

• ISO 27001 implementation and audit.
• NIST Cybersecurity Framework application.
• Penetration testing coordination.
• Artificial Intelligence security management.
• Data loss prevention and data security monitoring.
• Identity and Access Management (IAM) controls.
• Incident response planning and execution.
• Third‑party cyber risk assessment.