IT Security Officer – IT Resilience (Cybersecurity)

Location: Luxembourg (Siège Lux House)

Company

hirify.global supports ING Luxembourg’s banking operations through technology, information risk management, security, and operational resilience functions.

What you will do

• Translate Luxembourg regulatory obligations, technology requirements, and ING Group standards into local security controls and coordinate implementation with Technology teams and control owners.
• Assess and challenge cyber and IT risks, documenting threats, vulnerabilities, control effectiveness, residual risk, and proportionate mitigation measures.
• Own security remediation plans, agree priorities and deadlines, escalate delays, and support risk acceptance decisions.
• Improve IT resilience through backup governance, recovery testing, restoration assurance, destructive-attack resilience, and follow-up of weaknesses.
• Coordinate security reviews, control testing, audits, regulatory requests, and DORA-related activities with assurance functions, ING Group experts, and relevant third parties.
• Advise delivery teams on security requirements and risk treatment, provide reporting to management and ING Group stakeholders, and contribute to incident monitoring, control oversight, and audit support.

Requirements

• Master’s degree in information security, computer science, risk management, or a related field, or equivalent professional experience.
• At least five years of relevant experience in IT security, IT risk, technology risk, or security governance, including delivery across multiple teams or functions.
• Sound knowledge of cyber and IT risk management, security controls, and regulatory expectations, with practical familiarity with ISO 27001, NIST CSF, OWASP, PCI DSS, and DORA.
• Ability to assess control design and effectiveness, define proportionate remediation measures, and communicate risk to technical and management audiences.
• Experience in financial services or another regulated environment. Experience should ideally include IT resilience, backup and recovery governance, recovery testing, immutable or segregated backups, and ransomware resilience.
• Relevant professional certification such as CISA, CISM, CISSP, CRISC, ISO 27001 Lead Auditor, CBCI, or a recognised project-management qualification.
• Awareness of firewalls, proxies, data loss prevention, endpoint protection and detection, privileged access management, web application firewalls, and security information and event management.
• Proficiency with Microsoft 365 and experience with workflow, governance, or service-management tools such as ServiceNow.
• Familiarity with agile delivery and DevSecOps practices.
• Analytical judgement, structured and pragmatic execution, accountability, constructive challenge, curiosity about emerging threats and technologies, and the ability to adapt priorities.
• Clear and persuasive communication with effective stakeholder management across technical teams, control functions, and senior management.
• Fluent written and spoken English.

Nice to have

• Working knowledge of French.
• Exposure to Git, Azure Pipelines, or scripting.

Culture & Benefits

• Internal position within the IT Security team at ING Luxembourg.
• Collaboration with Technology, Information Risk Management, the CIO management team, ING Group security functions, and other ING entities.
• Bilingual IT Security and Identity and Access Management team environment.
• Work focused on strengthening banking security and operational resilience in a fast-changing environment.