ICT Risk Expert (Poland/Remote)

ZEN.COM is a smart financial app designed for your everyday life – at home and on the go. We make payments, online shopping, and personal finance management fast, secure, and effortless. With ZEN.COM, you can enjoy cashback on purchases, full control over your spending, and peace of mind thanks to purchase protection. A built-in multi-currency account lets you spend abroad or shop internationally with great exchange rates and no hidden fees.

We are looking for an ICT Risk Expert to support the identification, assessment, monitoring, and management of ICT and technology-related risks across our fintech organization.
The role will focus on establishing a structured and pragmatic approach to ICT risk management, ensuring that technology risks are identified, assessed, documented, and addressed in line with the organization's risk appetite, business objectives, and applicable regulatory requirements.
The successful candidate will work closely with Cyber Security, IT, Engineering, Operations, Business, and Compliance teams to understand technology risks, challenge risk assessments where necessary, and ensure that appropriate mitigation plans are defined and tracked.
This is a specialist risk management role focused on ICT risk identification, assessment, coordination, and monitoring, rather than the hands-on implementation of technical security controls or an independent internal audit function.

Requirements:

• Experience in ICT risk management, technology risk, operational risk, information security risk, or a related field.
• Experience in fintech, banking, payments, or another regulated financial services environment.
• Strong understanding of IT infrastructure, cloud services, applications, technology operations, and information security principles.
• Practical experience conducting ICT risk assessments and translating technical issues into clear business risk statements.
• Experience maintaining risk registers, assessing inherent and residual risk, defining mitigation plans, and monitoring remediation.
• Understanding of risk ownership, risk appetite, risk acceptance, escalation processes, and governance structures.
• Ability to challenge technical and business stakeholders constructively and ensure that identified risks are managed appropriately.
• Knowledge of ICT risk management frameworks and standards, such as ISO 27001, ISO 31000, NIST CSF, or COBIT.
• Familiarity with financial services regulatory requirements, particularly DORA and its ICT risk management provisions, where applicable.
• Understanding of third-party ICT risk, business continuity, disaster recovery, and operational resilience.
• Ability to work independently, prioritize competing activities, and operate effectively in a dynamic fintech environment.
• Professional proficiency in English.
• We would appreciate it if you could share your Gallup test or similar assessment results, if available. You can find a dedicated link in the application form on the next page.

Nice to Have:

• Experience implementing or improving an ICT risk management framework.
• Familiarity with cloud risk, software development lifecycle risks, technology resilience, and critical service dependencies.
• Relevant certifications such as CRISC, CISA, ISO 27001 Risk Manager, or other risk management qualifications.
• Experience supporting regulatory reviews, risk committees, or supervisory engagements.

Responsibilities:

• ICT Risk Management Framework: Develop, maintain, and continuously improve the ICT risk management framework, methodologies, procedures, and assessment criteria.
• Risk Identification and Assessment: Identify and assess risks related to IT infrastructure, applications, cloud services, information security, technology operations, system availability, and third-party dependencies.
• Risk Register Management: Maintain the ICT risk register, ensuring risks have clear descriptions, accountable owners, assessments, mitigation plans, and review dates.
• Risk Mitigation and Treatment: Work with risk owners to define appropriate mitigation measures, track remediation activities, challenge unrealistic timelines, and escalate overdue or insufficient actions.
• Risk Appetite and Reporting: Support the definition and monitoring of ICT risk indicators, thresholds, and key risk indicators (KRIs). Prepare clear risk reports for relevant management stakeholders.
• Risk Acceptance: Coordinate the risk acceptance process, ensuring residual risks are properly assessed, documented, justified, and approved by the appropriate decision-makers.
• Change and Project Risk Assessments: Assess ICT risks associated with significant technology changes, new products, system implementations, migrations, and architectural decisions.
• Third-Party and Outsourcing Risk: Support the assessment and ongoing monitoring of risks associated with ICT service providers, cloud providers, critical suppliers, and outsourced technology services.
• ICT Resilience and Continuity: Assess risks related to business continuity, disaster recovery, system availability, recovery capabilities, and technology dependencies.
• Incident and Problem Risk Analysis: Work with Cyber Security and IT teams to assess the risk implications of major incidents, identify recurring weaknesses, and track risk mitigation actions.
• Regulatory Alignment: Ensure the ICT risk management approach reflects relevant regulatory requirements, including DORA where applicable, and supports the organization's broader enterprise risk management framework.
• Stakeholder Collaboration: Facilitate discussions between technical teams, business stakeholders, and risk functions to ensure technology risks are understood and appropriately managed.
• Continuous Improvement: Identify gaps in risk management practices and improve the quality, consistency, and efficiency of ICT risk assessments and reporting.

What we offer:

• Real influence on shaping the ZEN.COM.
• Work in an environment where innovation and effectiveness truly matter.
• Competitive salary and flexible working conditions.
• Private medical healthcare.
• Internal and external training opportunities.