ICT, Cyber Risk & BCM Supervisor – 2nd Line of Defense

The ICT, Cyber Risk & BCM Supervisor – 2nd Line of Defense reports directly to the Chief Risk Officer (CRO) of SGSS S.p.A.

The ICT, Cyber Risk & BCM Supervisor is responsible for providing independent oversight, challenge, and risk advisory on Information and Communication Technology (ICT), Cybersecurity, Operational Resilience, and Business Continuity risks across the organization.

Operating within the Second Line of Defense, the role ensures that ICT and cyber risks are effectively identified, assessed, monitored, and managed in accordance with the organization's risk appetite, strategic objectives, and regulatory requirements.

The position acts as a key partner to the CISO and technology and security risks LOD1 counterparts, fostering a strong risk culture while maintaining constructive challenge over technology-related decisions, investments, and risk mitigation strategies.

The ICT, Cyber Risk & BCM Supervisor provide independent risk oversight and support the CRO in strengthening ICT risk governance and operational resilience.

The role also collaborates closely with Group Risk Management functions and central ICT Risk and BCM LOD2 teams to ensure alignment with corporate standards and regulatory expectations.

Tasks and responsibilities: 

• Supporting the CRO in monitoring ICT and Cyber Risks in cooperation with CIO and CISO functions

• Supporting the CRO in the definition and continuous evolution of the ICT risk management framework, including methodologies, metrics, and reporting

• Reviewing ICT risk assessments, control effectiveness and major ICT initiatives

• Contributing to the definition and monitoring of risk appetite, key risk indicators, and risk reporting

• Contributing to ICT risk reporting and management information

• Assessing emerging threats and ensuring that the organization’s cyber and operational resilience strategy remains adequate

• Overseeing third-party and supply chain cyber risk from a risk management perspective

• Ensuring alignment with relevant regulatory frameworks (e.g. DORA, NIS2, ISO 27001, and related ICT risk standards)

• Producing reports and position papers for senior management, in particular to assess the adequacy of action plans implemented by the business lines in response to major ICT risks and challenges

• Reviewing the conclusions of investigations into significant incidents, taking into account their nature and potential risk implications

• Assessing the impact on operational risks of decisions related to organizational changes, business activities, IT systems or new products

• Analyzing major projects, including their compliance with project management procedures and project risk management requirements

• Participating in the validation of local standards, applicable risk standards, supervisory controls and requested exceptions

The ideal candidate combines deep expertise in ICT and cybersecurity risk with a strong risk management and governance perspective, enabling effective independent oversight, challenge, and decision support in a highly regulated environment. Cyber risk and operational resilience are core areas of focus.

Studies & experience:

• 6+ years of experience in cybersecurity, ICT risk or technology risk management.

• Previous experience in ICT Risk, IT Governance, Internal Control, Operational Risk or Cyber Risk.

Language skills:

• Italian (C2): Excellent written and verbal communication skills, with the ability to communicate fluently and effectively in complex professional and regulatory environments

• English (B2): Able to communicate confidently in professional settings, participate in meetings, prepare reports and presentations, and collaborate effectively with international stakeholders

Technical, operational & Soft skills:

• Strong understanding of IT and cybersecurity frameworks such as NIST CSF, ISO 27001/27005, CIS Controls, COBIT

• Familiarity with regulatory expectations related to ICT and cyber risk

• Assessing the design and effectiveness of IT and cybersecurity controls

• Relevant certifications such as CISSP, CISM, CRISC, CISA or FAIR would be considered an advantage

• Strong risk-based mindset, with the ability to assess risk scenarios

• Ability to provide constructive and credible challenge to senior technology and cybersecurity stakeholders

• Collaborative mindset with the ability to work across functions and foster effective teamwork

• Excellent capability to translate complex technical and cyber risk issues into clear business insights and actionable recommendations for senior management

• Independence of judgment, critical thinking, and professional integrity

• Ability to influence without direct authority and operate effectively in a matrix environment

• Strong relationship-building capabilities

• Ability to manage conflict constructively and navigate complex stakeholder environments

• Commitment to innovation, simplification, continuous improvement, and operational excellence

• High level of accountability, resilience, and decision-making confidence

• Strong organizational and prioritization skills

SGSS has been present in Italy since September 2006 through a dedicated Italian Bank, SGSS S.p.A., one of the main players in the Securities Services' industry that covers all SGSS businesses for its two segments of clients: Financial Institutions & Brokers and Asset Managers & Insurance. Thanks to over 500 employees based in Milan and Turin, SGSS S.p.A. ensures a daily support to over 300 clients. Our clients are institutional investors (insurance companies and pension funds), asset managers, financial intermediaries (brokers, investments companies).

In a highly competitive and fragmented financial market, our ambition is to be the reference partner recognized for its service quality and competitiveness, its agile solutions and international network coverage. We are much more than a partnership: a genuine team. We build long-lasting, collaborative relationships with our clients to help them go further in their development. In today's constantly evolving and complex world, we strive to provide our clients with increasingly efficient and reliable Securities Services on a daily basis to ensure they get ahead.

Changing jobs is an opportunity for you to discover a new environment or a new job, participate in new projects and discover new teams, in Italy and abroad. It is also the way to share your expertise, to bring a new eye to better serve our customers tomorrow.

We are convinced that people are driving change, and that the world of tomorrow will be made up of all their initiatives, from the smallest to the most ambitious.

Then take the plunge!