IT Security Officer - IAM Expert

Your role & work environment

You will be the main local owner of Identity and Access Management (IAM) governance and control activities, while also supporting the broader activities of the Tech Security Team of ING Luxembourg.

As part of, and local point of contact for, the IAM Centre of Excellence (CoE) (which is partially located outside Luxembourg), you will oversee the IAM controls; analyze IAM risks and control gaps; provide specialist advice to local stakeholders; and coordinate timely remediation. You will also perform first-line monitoring and SOX control testing and contribute to broader IT security governance, risk and control activities performed by the overarching Tech Security team.

You will join a team of Security Officers working in English and French. IAM governance and controls will be your principal area of ownership, while team members support one another across their respective IT risk domains and share responsibility for day-to-day security governance, risk and control activities. The team works closely with Technology, Information Risk Management, the IAM CoE, the CIO management team and other ING entities.

Your key responsibilities

IAM governance and controls

• Own and coordinate local IAM governance and controls with the IAM CoE, supporting technology teams and control owners.
• Implement, monitor and improve IAM controls in line with ING Group standards, SOX requirements and local obligations.
• Perform first-line monitoring and KCT and SOX testing, including evidence review, documentation and assessment of control effectiveness.

IAM risk, remediation and stakeholder support

• Analyze IAM risks, control gaps and recurring access issues; identify root causes, track remediation, validate closure and escalate material issues.
• Recommend improvements to IAM processes, controls and technologies, and support audits, assurance reviews and regulatory requests.
• Advise technology and business stakeholders on IAM requirements, access-control questions and exceptions.

Broader IT security governance, risk and control activities

• Dedicate an agreed portion of the role to broader IT security governance, risk and control activities, including risk assessments, security reviews, incident analysis, audit and regulatory support, reporting and risk remediation follow-up

We look for

A colleague with a talent for taking it on and making it happen, enthusiasm for helping others to be successful and a knack for always being a step ahead. In other words, you strive to bring fresh ideas to life and embrace challenges in a fast changing and complex environment. You are a naturally collaborative person who listens and invests in others to achieve common goals. You love to challenge the status quo and are eager to propose creative solutions to problems.

As an IT Security Officer with a focus on IAM you will also need:

• Master’s degree in information security, computer science, risk management or a related field, or equivalent professional experience.
• At least five years of relevant experience in IAM, IT security, IT risk, internal controls or technology assurance, including independent ownership of IAM governance or control activities. 
• Functional knowledge of ING’s IAM processes, such as joiner-mover-leaver, access provisioning, privileged access, periodic access reviews, segregation of duties, authentication and authorization controls. 
• A thorough technical understanding of identity governance, privileged access management, directory services, authentication and access-certification platforms.
• Ability to interpret policies, standards and regulatory requirements and translate them into practical control expectations and actions.
• Hands-on experience in control design or testing, evidence assessment, deficiency management and remediation, with the ability to translate requirements into practical controls.
• Strong ownership, planning and coordination skills, with the ability to manage recurring control activities and deadlines independently.
• A rigorous, evidence-based approach with close attention to completeness, accuracy and auditability.
• Strong analytical skills and the ability to translate control weaknesses into clear risks, actions and priorities.
• Effective communication and stakeholder management across technical and non-technical audiences, including the ability to challenge constructively.
• A collaborative, pragmatic and delivery-focused mindset, with the flexibility to support broader IT Security priorities.
• Fluent written and spoken English is required.

The following would be advantageous:

• Working knowledge of French is a (big) advantage.
• Experience with SOX IT general controls or comparable assurance requirements, preferably in financial services.
• Knowledge of ISO 27001, NIST Cybersecurity Framework, COBIT and DORA.
• A relevant certification, such as CISA, CISM, CISSP, CRISC, CGEIT or ISO 27001 Lead Auditor, and experience working with central expertise and assurance functions.
• Experience working across local and international teams, central centers of expertise, auditors and other assurance functions.

We redefine banking. What about you?

There has never been a more interesting time to work at ING. We’re on a journey that’s centred around our customers, powered by technology and driven by smart, determined people. Our customers feel our people are empowering them to stay a step ahead in life and in business. We’re proud of that!