ICT Supply Chain Risk Management Specialist - Brno

Shape how we manage ICT third-party risk Technology, cloud services and external providers are essential to modern banking. Managing the associated risks is key to maintaining secure and resilient operations.

We are strengthening our ICT Supply Chain Risk Management capability within the 2nd Line of Defence. Our team covers ICT-related third-party risks across the full lifecycle, from classification and risk assessment through contracting and monitoring to incidents and exit.

As part of our global mandate, we promote a consistent approach across the Group and support international locations and subsidiaries in applying common requirements and standards. Whether your background is in ICT, risk management, information security, audit, compliance or third-party management, we are interested in your perspective. You do not need to be a cybersecurity expert from day one. What matters is your ability to understand risk, think analytically and develop your technology expertise. Depending on your experience and interests, you can contribute across Lifecycle Advisory, Methodology and Requirements, Assurance and Monitoring, or Risk Oversight and Reporting.

Depending on your experience and professional focus:

You assess and challenge ICT third-party risks across the provider lifecycle, from initial classification to exit.

• You contribute to risk methodologies, minimum requirements, governance and 2nd Line controls.
• You review risk assessments, contracts, due diligence evidence, residual risks and mitigation measures and provide well-founded recommendations.
• You advise stakeholders on ICT risk considerations related to provider selection, contracting, ongoing management, transition and exit.
• You support the consistent implementation of ICT third-party risk requirements across international locations and subsidiaries, providing guidance and challenging adherence where appropriate.
• You contribute to risk-based provider monitoring, cyber-posture assessments, security reviews, inspections and incident follow-up.
• You analyse dependencies, concentration risks and changes in provider risk profiles and support appropriate mitigation and escalation.
• You contribute to the review of exit strategies, transition plans and related testing.
• You translate risk information into meaningful KP Is, KR Is and management reporting.
• You collaborate across the Group and help continuously improve our methods, processes, controls and supporting tools.
• You have a degree, vocational qualification or relevant professional experience in IT, business, risk management, audit, compliance or a related field.
• You bring initial or advanced experience in one or more areas such as ICT or operational risk, information security, third-party risk, audit, compliance, controls, resilience or vendor management.
• You have a strong interest in technology, cybersecurity and digital resilience and are motivated to continue learning.
• You combine an analytical mindset with the ability to make complex topics understandable and challenge them constructively.
• You work in a structured and pragmatic way, take ownership and collaborate effectively across functions and countries.
• You communicate and document confidently in English. German is an advantage.
• Knowledge of DORA, ISO 27001, NIST, vendor assessments, ICT contracts or third-party risk management is beneficial. Relevant certifications such as CISSP, CISM or CRISC are an advantage, but not a prerequisite.
• You do not need to meet every criterion. We welcome both developing specialists and experienced professionals and will align responsibilities with your experience and strengths.
• Home office to make sure you can have the right balance.
• Flexible working hours within agile setup.
• Generous package of 6 weeks of vacation, 6 sick days and up to 30 days of paid sick leave.
• A competitive salary with a very decent annual bonus system.
• Special financial conditions and mortgage discount.
• Sponsored public transport card, Multisport card, retirement savings contribution, cafeteria system benefits, children summer camps contribution and free coffee.
• Opportunity to travel to our Frankfurt headquarters.
• A friendly, inclusive and open-minded company culture.
• Amazing multicultural colleagues and so much more!

Are you ready to help shape the future of ICT Supply Chain Risk Management in an international team? We look forward to receiving your online application, either full-time or part-time, by 30 November 2026. Dragos-Matei Ene, GRM-ICT RRM, will be happy to answer.