IT Risk & Compliance Officer (m/f/d)

About the role

The Commission de Surveillance du Secteur Financier (CSSF), Luxembourg's financial sector supervisor, is recruiting an IT Risk & Compliance Officer for its Information Systems Security service. In this full-time role you will help protect the CSSF's information systems by mapping IT risks, checking that the organisation's technology complies with its policies, standards and regulatory obligations, and making sure the right controls are in place. You will assess compliance through risk assessments, controls and action plans, and you will review, design and deploy IT risk management arrangements and the controls that go with them. You will manage IT incidents and problems, keep the IT service's procedures and policies up to date, and act as the IT contact point for auditors, both internal and external. You will also handle IT activities linked to the GDPR and take part in the CSSF's business continuity programme, helping the organisation stay resilient when things go wrong. Working closely with teams across the CSSF, including Internal Audit and Risk Management, you will bring rigour, technical knowledge and a clear understanding of regulatory frameworks to a role that sits at the heart of the supervisor's digital resilience.

Responsibilities

- Map IT risks across the CSSF's information systems - Assess compliance with policies, standards and regulations through risk assessments, controls and action plans - Review, design and deploy IT risk management arrangements and associated controls - Manage IT incidents and problems - Create, update and manage IT service procedures and policies - Manage internal and external IT audits as the IT contact point for auditors - Manage IT activities linked to the GDPR - Participate in the CSSF business continuity programme (BCP)

Requirements

EU national. Master's degree (at least level 7) or an equivalent qualification. University degree (BAC+4/BAC+5) specialising in information systems management and/or security. At least 3 years' experience in the field. Very good written and oral French and English. Knowledge of the three administrative languages (Luxembourgish, French, German). Strong technical knowledge of IT systems and infrastructure and an understanding of risk management and treatment frameworks.

Preferred qualifications

Knowledge and experience of regulatory frameworks and compliance standards such as ISO27K and NIS2; knowledge of GDPR laws and regulations; experience working with cross-functional roles such as Internal Audit or Risk Management; business analyst experience; knowledge of the financial sector; Luxembourgish and German are assets.

Skills