ICT Supply Chain Risk Management Specialist

Technology, cloud services and external providers are essential to modern banking. Managing the associated risks is key to maintaining secure and resilient operations.

We are strengthening our ICT Supply Chain Risk Management capability within the 2nd Line of Defence. Our team covers ICT-related third-party risks across the full lifecycle, from classification and risk assessment through contracting and monitoring to incidents and exit.

As part of our global mandate, we promote a consistent approach across the Group and support international locations and subsidiaries in applying common requirements and standards. Whether your background is in ICT, risk management, information security, audit, compliance or third-party management, we are interested in your perspective. You do not need to be a cybersecurity expert from day one. What matters is your ability to understand risk, think analytically and develop your technology expertise. Depending on your experience and interests, you can contribute across Lifecycle Advisory, Methodology and Requirements, Assurance and Monitoring, or Risk Oversight and Reporting.

Your tasks

Depending on your experience and professional focus:

• You assess and challenge ICT third-party risks across the provider lifecycle, from initial classification to exit.
• You contribute to risk methodologies, minimum requirements, governance and 2nd Line controls.
• You review risk assessments, contracts, due diligence evidence, residual risks and mitigation measures and provide well-founded recommendations.
• You advise stakeholders on ICT risk considerations related to provider selection, contracting, ongoing management, transition and exit.
• You support the consistent implementation of ICT third-party risk requirements across international locations and subsidiaries, providing guidance and challenging adherence where appropriate.
• You contribute to risk-based provider monitoring, cyber-posture assessments, security reviews, inspections and incident follow-up.
• You analyse dependencies, concentration risks and changes in provider risk profiles and support appropriate mitigation and escalation.
• You contribute to the review of exit strategies, transition plans and related testing.
• You translate risk information into meaningful KPIs, KRIs and management reporting.
• You collaborate across the Group and help continuously improve our methods, processes, controls and supporting tools.

Your Profile

• You have a degree, vocational qualification or relevant professional experience in IT, business, risk management, audit, compliance or a related field.
• You bring initial or advanced experience in one or more areas such as ICT or operational risk, information security, third-party risk, audit, compliance, controls, resilience or vendor management.
• You have a strong interest in technology, cybersecurity and digital resilience and are motivated to continue learning.
• You combine an analytical mindset with the ability to make complex topics understandable and challenge them constructively.
• You work in a structured and pragmatic way, take ownership and collaborate effectively across functions and countries.
• You communicate and document confidently in English. German is an advantage.
• Knowledge of DORA, ISO 27001, NIST, vendor assessments, ICT contracts or third-party risk management is beneficial. Relevant certifications such as CISSP, CISM or CRISC are an advantage, but not a prerequisite.
• You do not need to meet every criterion. We welcome both developing specialists and experienced professionals and will align responsibilities with your experience and strengths.

Our Benefits

• 30 days of vacation
• Employer-funded pension
• Flexible work
• Employee conditions
• Digital learning
• Diversity
• Family & job friendly
• Friendly work environment
• Inspiring company culture
• Work-life balance

The company

Group ICT Risk & Resilience Management (GRM-ICT RRM) steers and further develops the bank-wide ICT risk management framework and digital operational resilience within the 2nd Line of Defence. This includes the management of ICT, information-security and cyber risks and the implementation of regulatory requirements such as DORA.

ICT Enablement & Compliance translates regulatory and business requirements into effective advisory, controls and third-party risk management processes. ICT Supply Chain Risk Management brings together the ICT risk perspective across the third-party lifecycle and works with specialist functions across risk management, information security, resilience, incident management and reporting.

Contact

Are you ready to help shape the future of ICT Supply Chain Risk Management in an international team? We look forward to receiving your online application, either full-time or part-time, by 30 October 2026.