Information Security and Risk Officer

Job Description

Bank of China (Europe) S.A is looking for an Information Security and Risk Officer to reinforce its IT Risk Management Team. The Bank is currently enhancing its Information Security and Resiliency Program. The main goal of this position is to assist the Bank’s Information Security Officer, implementing policies, procedures, technical measures and documenting evidence.

Main Responsibilities

ICT Risk Management, Control Oversight & Compliance

• Provide independent second line oversight and challenge of information security related topics.
• Perform ICT risk assessment by gathering information and conducting interview and inspection.
• Propose, implement and track effective risk mitigation plans, policies, processes and technical controls.
• Maintain compliance documentation and support regulatory reporting activities.
• Coordinate the design, planning, execution, and enhancement of the ICT controls library.
• Review, challenge, and validate ICT controls.
• Ensure controls are evidenced for regulatory compliance purposes, identify gaps and opportunities for enhancement.

Business Continuity Management & Operational Resilience

• Perform and maintain Business Impact Assessment (BIA).
• Assist in developing and maintaining business continuity documentation.
• Participate in BCP testing activities and document test results.
• Support digital operational resilience testing activities.

Information Security-related Policies and Program Management

• Maintain and develop information security framework in alignment with local regulatory expectations, and taking into account Head Office group-policies.
• Support European information security initiatives, including policy governance, risk, control assessment and remediation effort, by participating or overseeing information security programs.
• Participate in resilience awareness program, providing orientation, training materials and session.
  (Cyber, Incident, Crisis Management, Business Continuity, etc..)

ICT Third Party Risk Management (TPRM)

• Help performing security & business continuity due diligence and risk assessments on new and existing ICT service providers.
• Monitor third-party compliance.
• Follow up on third-party security incidents, escalation and reporting.
• Update materials related to ICT Third Party Risk Management.

Stakeholder Management

• Act as the bridge between Risk Management, Head Office, IT, Third-Party Service Providers, Cross-border branches and Business teams.
• Advocate a culture of risk management by providing guidance, challenge, and oversight.

Qualifications

Technical Skills & Qualifications

• University degree (minimum an equivalent to a Bachelor).
• At least 3 years of relevant experience in the area of IT or information security.
• Strong experience in ICT risk management, cyber risk, and regulatory oversight.
• Experience with business continuity, disaster recovery, cyber, and IT control effectiveness assessments.
• Experience overseeing or implementing ICT project, or transformations.
• Efficiency with GRC tooling, risk management, and executive-level reporting.
• Fluent in both English and Chinese is preferred.

Soft Skills & Attributes

• Strong analytical mindset with the ability to assess complex ICT and cyber risk scenarios and translate them into clear management insights.
• Excellent stakeholder management skills, with the confidence to challenge senior leaders constructively.
• Ability to operate independently, prioritize effectively, and escalate blocking issues to your manager.
• Resilience and composure in high-pressure environments, including incident response and regulatory scrutiny.

Additional Information

Compensation: The remuneration for this position will be determined based on the requirements and responsibilities of the role, as well as the candidate’s qualifications and professional experience. Further information on the applicable salary range will be provided during the recruitment process.

Equal Opportunity: We are committed to providing equal employment opportunities to all candidates and do not discriminate on the basis of gender, age, nationality, race, ethnic or social origin, religion or belief, disability, sexual orientation, or any other characteristic protected by applicable law.