SPECIALIST Especialista de Riscos Não Financeiros | Cyber e IT (2LoD)
Country: Portugal
START HERE
Santander (www.santander.com) is evolving from a global brand of great impact into a technology-driven organization, and our people are at the center of this journey.
Together, we are leading a customer-centric transformation that values critical thinking, innovation and the courage to challenge what is possible.
This is more than a strategic change. It is an opportunity for motivated people to grow, learn and make a real difference.
Our mission is to contribute to more people and businesses prospering. We have adopted a strong risk culture, and all our people, at all levels, play an active and responsible role in risk management.
YOUR IMPACT
Santander Portugal is looking for a Non-Financial Risk Specialist | Cyber and IT (2LoD) for Lisbon.
We are redefining the way we work through innovation, cutting-edge technology, collaboration and the freedom to explore new ideas.
To succeed in this role, you will be responsible for:
Oversight of Cyber and IT Frameworks
— Exercising oversight and challenge over the 1st Line of Defense regarding the design, implementation and effectiveness of Cybersecurity and IT risk frameworks, assessing alignment with corporate and regulatory requirements and with the Bank's risk appetite.
Independent Assessment of Risk Profile
— Analyzing risk assessments, indicators, vulnerabilities, exceptions, control deficiencies and remediation plans, ensuring an independent view of the technological and cyber risk profile.
Governance, Policies and Standards
— Reviewing and challenging Cyber and IT policies, regulations, methodologies and standards, ensuring clarity of responsibilities, consistency between frameworks and adequate integration into the global non-financial risk model, and promoting a risk culture aligned with the Organization's risk appetite.
Incidents, Testing and Technological Resilience
— Monitoring relevant technological and cybersecurity incidents, exercises, control testing and resilience assessments, including incident reporting, digital resilience testing and third-party risk management under DORA, challenging causes, impacts, lessons learned and the sufficiency of corrective measures.
Monitoring, Reporting and Escalation
— Monitoring KRIs, trends, material risks and action plans, preparing analyses and reporting for governance forums, executive committees, audits and supervisory authorities, and promoting escalation when applicable.
Monitoring of Artificial Intelligence Risks
— Monitoring risks associated with the use of Artificial Intelligence, including governance, use-case inventory, risk classification, technological dependencies, third parties, data quality and regulatory developments, coordinating with specialist areas.
YOUR CONTRIBUTION
Our people are our greatest strength. Each individual contributes unique perspectives that make us stronger as a team and as an organization.
We empower teams to go further, valuing who they are and leveraging what they bring.
The following requirements represent the knowledge, skills and abilities essential for success in this role. Reasonable adjustments will be considered to enable people with disabilities to perform the essential functions.
Professional Experience
— Minimum of 5 years of professional experience in at least one of the following areas: IT Risk, Cybersecurity, Information Security, IT Governance, Information Systems Auditing, Internal Control or Operational Risk with technological specialization.
— Experience in 2nd Line of Defense functions, auditing or independent oversight of IT and Cyber frameworks will be valued.
Academic Background
— Higher education in Computer Engineering, Information Systems, Cybersecurity, Engineering, Management or a relevant field.
— Certifications such as CISA, CISM, CRISC, CISSP, ISO/IEC 27001 Lead Auditor/Implementer, COBIT or equivalents will be valued.
Languages
— Portuguese (fluent)
— English (valued)
— Spanish (valued)
Hard Skills
— Solid knowledge of technological and cyber risk frameworks and standards, such as NIST CSF, ISO/IEC 27001, COBIT and EBA/ECB guidelines, as well as applicable DORA requirements.
— Ability to assess IT and Cyber governance models, processes and controls, analyze KRIs and remediation plans and produce executive reporting; basic knowledge of Artificial Intelligence risk and governance, including AI Act, NIST AI RMF or ISO/IEC 42001, will be valued.
Soft Skills
— Analytical ability, critical thinking, rigor and independence of judgment, with aptitude for constructive and sustained challenge to the 1st Line of Defense.
— Excellent written and verbal communication, ability to synthesize, organization, collaboration and influence with technical and non-technical stakeholders.
WE VALUE YOUR IMPACT
Your contribution matters and will be recognized. You can expect a fair and competitive compensation package, reflecting the impact you create and the value you deliver.
But we know that rewards go far beyond numbers.
•We offer more than a salary. Our benefits are designed to support your life, your goals and your well-being, now and in the future.
•Your health is our priority. Through BeHealthy, our global well-being program, we promote holistic well-being.
•We know that family is everything. That's why we offer parental leave, childcare support and programs tailored to every stage of life.
•We empower our teams through global opportunities and diverse career paths.
•We believe in the power of helping. You can dedicate part of your working time to volunteer activities.
We are here to keep you motivated, help you achieve your goals and celebrate your progress at every step of the way.
LOCAL COMPLIANCE
Santander is proud to be an organization that promotes equal opportunities, regardless of age, gender, disability, marital status, race, religion or sexual orientation.
We are committed to offering an inclusive and accessible application process to everyone.
WHAT TO DO NEXT
If you think this role is of interest to you, apply.
