Information Security & Risk Officer

As a Luxembourg-based bank since 1979, together with the global presence of Bank of China Group, Bank of China Luxembourg Branch has been successfully operating and continuously developing its business over the years. It contributes to the local and worldwide economic and social development. With more than 45 years of expertise and experience in the European markets, the bank extended its roots covering 15 institutions located in 13 European countries and becoming Bank of China Europe, since 2022. Bank of China Europe adheres to the guidance of Bank of China group and continues to grow and expand its business coverage across the world, offering comprehensive business solutions to its clients worldwide with its globalized operations and diversified platforms. Today, Bank of China Europe comprises an international workforce with a multicultural background of more than 30 different countries and regions with over 600 employees. Bank of China (Europe) S.A is looking for an Information Security and Risk Officer to reinforce its IT Risk Management Team. The Bank is currently enhancing its Information Security and Resiliency Program. The main goal of this position is to assist the Bank’s Information Security Officer, implementing policies, procedures, technical measures and documenting evidence. Main Responsibilities ICT Risk Management, Control Oversight & Compliance Provide independent second line oversight and challenge of information security related topics. Perform ICT risk assessment by gathering information and conducting interview and inspection. Propose, implement and track effective risk mitigation plans, policies, processes and technical controls. Maintain compliance documentation and support regulatory reporting activities. Coordinate the design, planning, execution, and enhancement of the ICT controls library. Review, challenge, and validate ICT controls. Ensure controls are evidenced for regulatory compliance purposes, identify gaps and opportunities for enhancement. Business Continuity Management & Operational Resilience Perform and maintain Business Impact Assessment (BIA). Assist in developing and maintaining business continuity documentation. Participate in BCP testing activities and document test results. Support digital operational resilience testing activities. Information Security-related Policies and Program Management Maintain and develop information security framework in alignment with local regulatory expectations, and taking into account Head Office group-policies. Support European information security initiatives, including policy governance, risk, control assessment and remediation effort, by participating or overseeing information security programs. Participate in resilience awareness program, providing orientation, training materials and session. (Cyber, Incident, Crisis Management, Business Continuity, etc..) ICT Third Party Risk Management (TPRM) Help performing security & business continuity due diligence and risk assessments on new and existing ICT service providers. Monitor third-party compliance. Follow up on third-party security incidents, escalation and reporting. Update materials related to ICT Third Party Risk Management. Stakeholder Management Act as the bridge between Risk Management, Head Office, IT, Third-Party Service Providers, Cross-border branches and Business teams. Advocate a culture of risk management by providing guidance, challenge, and oversight. Technical Skills & Qualifications University degree (minimum an equivalent to a Bachelor). At least 3 years of relevant experience in the area of IT or information security. Strong experience in ICT risk management, cyber risk, and regulatory oversight. Experience with business continuity, disaster recovery, cyber, and IT control effectiveness assessments. Experience overseeing or implementing ICT project, or transformations. Efficiency with GRC tooling, risk management, and executive-level reporting. Fluent in both English and Chinese is preferred. Soft Skills & Attributes Strong analytical mindset with the ability to assess complex ICT and cyber risk scenarios and translate them into clear management insights. Excellent stakeholder management skills, with the confidence to challenge senior leaders constructively. Ability to operate independently, prioritize effectively, and escalate blocking issues to your manager. Resilience and composure in high-pressure environments, including incident response and regulatory scrutiny. — Published by Bank of China Luxembourg. Apply on the employer's own posting.