IT Security Officer – IT Resilience
Your role & work environment
ING Luxembourg is looking for an IT Security Officer – IT Resilience (m/f) for an internal vacancy within the IT Security team. The role focuses on strengthening IT resilience, with particular responsibility for backup and recovery assurance, ransomware preparedness, security risk management and regulatory alignment.
You will work across Technology, risk and assurance functions to translate security requirements into practical improvements, provide constructive challenge and support informed decision-making. You will join a bilingual team of IT Security and Identity and Access Management Officers. The team works closely with Technology, Information Risk Management, the CIO management team, ING Group security functions and other ING entities to strengthen the bank’s security and operational resilience.
Your key responsibilities
- Translate Luxembourg regulatory obligations, technology requirements and ING Group standards into clear local control requirements, and coordinate their implementation with Technology teams and control owners.
- Perform and challenge cyber and IT risk assessments, ensuring that threats, vulnerabilities, control effectiveness, residual risk and proportionate mitigation measures are clearly documented.
- Own and monitor security remediation plans, agree priorities and target dates with accountable stakeholders, and escalate material delays or risk acceptance decisions.
- Drive improvements in IT resilience, including backup governance, recovery testing, restoration assurance, resilience against destructive attacks and follow-up of identified weaknesses.
- Coordinate security reviews, control testing, audit and regulatory requests—including DORA-related activities—with assurance functions, ING Group experts and relevant third parties.
- Provide concise reporting on risk exposure, control performance, remediation progress, key issues and required decisions to local management and ING Group stakeholders.
- Advise delivery teams on security requirements and pragmatic risk treatment, helping them make timely, risk-informed decisions throughout the change lifecycle.
- Contribute to the IT Security team’s operational activities, including security incident monitoring and analysis, control oversight, audit support and emerging priorities.
We look for
A colleague with a talent for taking it on and making it happen, enthusiasm for helping others to be successful and a knack for always being a step ahead. In other words, you strive to bring fresh ideas to life and embrace challenges in a fast changing and complex environment. You are a naturally collaborative person who listens and invests in others to achieve common goals. You love to challenge the status quo and are eager to propose creative solutions to problems.
As a IT Security Officer – IT Resilience you will also need:
- Master’s degree in information security, computer science, risk management or a related field, or equivalent professional experience.
- At least five years of relevant experience in IT security, IT risk, technology risk or security governance, including delivery across multiple teams or functions.
- Sound knowledge of cyber and IT risk management, security controls and regulatory expectations, with practical familiarity with frameworks and standards such as ISO 27001, NIST CSF, OWASP, PCI DSS and DORA.
- Demonstrated ability to assess control design and effectiveness, define proportionate remediation measures, and communicate risk clearly to technical and management audiences.
- Experience in financial services or another regulated environment, ideally covering IT resilience, backup and recovery governance, recovery testing, immutable or segregated backups, and ransomware resilience.
- A relevant professional certification, such as CISA, CISM, CISSP, CRISC, ISO 27001 Lead Auditor, CBCI or a recognised project-management qualification.
- Awareness of the purpose and control considerations of core security technologies, including firewalls, proxies, data loss prevention, endpoint protection and detection, privileged access management, web application firewalls and security information and event management.
- Proficiency with Microsoft 365 and experience using workflow, governance or service-management tools such as ServiceNow.
- Familiarity with agile delivery and DevSecOps practices; exposure to Git, Azure Pipelines or scripting is an advantage.
- Analytical judgement, with the ability to identify material issues, challenge assumptions and turn complex requirements into prioritised actions.
- Clear and persuasive communication, with effective stakeholder management across technical teams, control functions and senior management.
- A structured, pragmatic and results-oriented approach, combined with accountability and the confidence to challenge constructively.
- Curiosity about emerging threats and technologies, with the ability to learn quickly and adapt priorities in a changing environment.
- Fluent written and spoken English is required. Working knowledge of French is considered an advantage.
We redefine banking. What about you?
There has never been a more interesting time to work at ING. We’re on a journey that’s centred around our customers, powered by technology and driven by smart, determined people. Our customers feel our people are empowering them to stay a step ahead in life and in business. We’re proud of that!