ICT Risk Officer, Risk & Compliance

Role Overview

The ICT Risk Officer independently evaluates technology risks across the organization, from core infrastructure and business systems to projects and external providers. The role turns risk findings into clear reporting and practical mitigation plans, helping leaders make informed decisions and keep technology activities aligned with business priorities and regulatory obligations.

Key Responsibilities

• Maintain the ICT risk framework and register, documenting exposures, controls, owners, treatment plans, and progress.
• Assess risks across technology platforms, infrastructure, projects, and third-party services, and evaluate whether controls are working effectively.
• Track technology risk indicators and mitigation actions; prepare regular reports for management and relevant committees, escalating material concerns promptly.
• Evaluate evolving exposures related to cybersecurity, cloud adoption, digital initiatives, and artificial intelligence.
• Review the organization’s security posture, incident handling, vulnerability findings, and remediation progress, including controls supported by SIEM, EDR, DLP, firewalls, and endpoint security tools.
• Check technology activities against applicable regulatory requirements and contribute to ICT-focused internal and external audits.
• Support risk reviews for new systems and projects, as well as assessments of business continuity and disaster recovery arrangements.
• Assess vendor technology risks, review relevant contractual and control provisions, and monitor outsourced services for changes in exposure.

Requirements & Qualifications

• Bachelor’s degree in Information Technology, Computer Science, Information Systems, Risk Management, or a related discipline.
• More than three years of experience in ICT risk, technology audit, IT governance, enterprise risk management, or a closely related field.
• Experience in a regulated industry is desirable.
• Knowledge of technology risk assessment, control evaluation, governance, and regulatory compliance.
• Strong analytical skills, with the ability to identify material exposures and monitor risk treatment to completion.
• Clear report-writing and communication skills, including the ability to explain technical risks to business and management stakeholders.
• Relevant certification is an advantage, such as CRISC, CISA, CGEIT, ISO 31000 Risk Management, or CISSP.