Third Party Risk Specialist, ICT (DORA)

Banking is changing, and we're building the bank that's driving that change. Lunar is a Nordic challenger bank, founded in Copenhagen in 2015, with offices in Copenhagen, Aarhus, and Stockholm. We're putting AI at the core of how we build and run the bank, but knowing exactly who we're doing business with still comes down to people, and that's what this team does.

As our new Third Party Risk Specialist, ICT (DORA) you'll join Legal & First Line Risk in Aarhus or Copenhagen, reporting to our Director of Legal & First Line Risk. Most of what Lunar buys is technology, so the risk in our ICT vendors is part of running the bank. We're building third party risk as its own area, alongside a growing procurement function. Procurement owns sourcing, price and negotiation. You own the risk on every ICT vendor, before and after we sign, and you get to shape how the area works. It's a new role, so you'll be building it while you run it.

What will you do?

• Assess before we sign. Run classification, due diligence and risk assessments on every ICT vendor that comes through procurement, with a close eye on services supporting critical or important functions, cloud, subcontracting chains and where our data sits.

• Set what the contract must say. Work with Legal to define the requirements, including DORA Article 30 terms, SLAs, audit rights and exit rights.

• Follow critical vendors after we sign. Track SLA performance, run vendor reviews, follow ICT incidents and assurance reports such as ISAE 3402 and SOC 2, and reassess when something changes.

• Keep the register and exit plans right. Own the DORA register of information and our ICT concentration risk input, and make sure critical services have exit strategies that would actually work.

• Build the area while you run it. Work day to day with procurement, and report to management, 2nd line, internal audit and the Danish FSA.

What are we looking for in you?

• Hands-on experience with ICT third party risk under DORA at a bank, payment institution, pension or insurance company, or as an adviser to one.

• First line experience. You've run risk assessments and due diligence yourself, not only overseen others doing them, and you're comfortable working independently and building an area without formal training.

• You've managed ICT vendors after the signature, including SLAs, reviews, reassessment and exit planning for critical vendors.

• You read an ICT contract and spot what's missing, from Article 30 terms and audit rights to exit rights and subcontracting.

• Fluent in English, with the right to work in Denmark and the ability to work from our Aarhus or Copenhagen office.

• It's a plus if you speak Danish or another Scandinavian language, have owned a DORA register of information before, or can judge what an ISAE 3402 or SOC 2 report does and does not cover.

Benefits and perks

• 4 days in the office. We're a team that builds together, thinks together, and moves together. Showing up is part of how we work.

• State of the art equipment. The newest computer, monitor, mouse, and keyboard. We want you to do your best work without anything slowing you down.

• Pension, health insurance, and enhanced parental leave. From your financial future to your family moments. We've got you covered.

Are you ready to join the journey? Apply now and let's find out more!

While you hold on tight for us to get back to you, curious to see what we’re up to? Follow us on LinkedIn for business announcements and releases 📢, check out our Instagram for an inside scoop on what it’s like to work here .

Depending on the regulations in the country where you will be employed, we will ask to see or obtain information about your criminal record. Please note that our employment is conditional upon you not being registered in RKI (Ribers Kredit Information).

We welcome applications from candidates of all backgrounds. If you need any adjustments during the recruitment process, please let us know