ICT risk supervision – Analyst micro/macro (m/f/d), Luxembourg

Commission de Surveillance du Secteur Financier (CSSF) acts exclusively in the public interest. Our aim is to protect financial consumers and to promote fairness, transparency and security within the financial sector, one of the main pillars of the Luxembourg economy.

The CSSF is also distinguished by its strong involvement at European and international level. Our staff actively participate in working groups set up by international institutions and work closely with other European authorities, with the shared aim of promoting financial stability at European and international level.

Tasks

• Involvement in the Joint Examination Teams (minimum 50% of your activity):
• Participate to examination activities of CTPPs, i.e. general investigations and ongoing monitoring
• Interact and cooperate with specialists of the CTPPs, with the joint examination team members
• Draft all or part of key deliverables
• Activities of the specialised team within the CSSF (up to 50% of your activity):
• Analyse the sections relating to ICT organisation and ICT risk management in application files for authorisation of future professionals of the financial sector
• Analyse the notifications for use of ICT third party service providers of entities supervised by the CSSF
• Provide expertise and support to other supervisory departments in assessing the compliance of supervised entities with the DORA regulation
• Provide various types of advice to other supervisory departments (advice on supervised entities’ IT strategy, their digital transformation, findings raised by their internal or external IT auditors, etc.)
• Participate in transversal analyses on topics related to ICT risk management
• Participate to national and international working groups dedicated to ICT and ICT risk supervision
• Please note that this position will require frequent business trips.

Profile

• University degree (at least BAC+3/Bachelor) in information systems audit, or in IT security with a specialization in finance, or in economics, finance or business management with an ICT specialization
• Proven professional experience of at least 3 years in either the field of information systems auditing or in ICT risk management
• Perfect command of written and spoken English. Fluency in French and/or German. Knowledge of Luxembourgish will be considered as an advantage
• Commitment to be available for business trips abroad
• Excellent knowledge of the DORA European regulation
• Excellent knowledge of the CSSF circulars notably relating to ICT risk management and to ICT outsourcing
• Knowledge of other European regulation in this area (i.e., PSD, eIDAS, NIS, MICA etc.) and interest in new technologies and digital solutions (DLT, AI, virtual currencies/crypto assets, open banking/finance, etc.) constitute an advantage
• CISA, CISM, CISSP or equivalent certifications are an asset
• Writing, analytical, synthesis skills and thoroughness
• Proactivity and flexibility
• Ability to work independently as well as good team spirit
• Communication skills
• Confidentiality