Senior ICT Risk Manager

We’re in an exciting phase where we’re scaling both from a market perspective and also from a product perspective, and we want someone who can help us do it safely and smartly. As our Senior ICT Risk Manager, you’ll take real ownership of our second line, bringing technical depth, a collaborative mindset and the confidence to ask the right questions.About the role:We are part of NOBA’s Risk Control function, building a strong second line within our Non-Financial Risk framework. Our purpose is to give management and the Board an independent view of risk, while working constructively with the first line and IT. We keep things practical, open and focused on the risks that truly matter, across Oslo and Stockholm.You’ll strengthen NOBA’s ICT risk management and provide independent oversight of our AI governance framework. You’ll challenge the first line, guide the business and turn complex technology risks into clear analysis that supports good decisions, regulatory compliance and resilience.Main tasks:Own our second-line ICT methodology, including risk classifications and minimum requirements for assessment, documentation, treatment and reportingDefine requirements for ICT risk data and reporting, and give Risk Control, management and the Board an independent view of our risk profileGuide the first line and monitor consistent application of the framework, including alignment with DORAOversee and challenge our AI governance framework, covering roles, policies, approval processes, lifecycle controls and monitoring, and escalate material gapsReview and challenge the first line’s risk assessments, risk acceptance decisions and treatment plans across technology, cyber security, access management for critical systems, third parties and projectsMake sure independent security assessments, including penetration tests, are risk-based and well scoped, and that significant findings are followed through to remediation or approved risk acceptanceMonitor and challenge the ICT risk aspects of business continuity, disaster recovery and operational resilience, including whether recovery works in practiceReview significant ICT incidents from a risk and governance perspective, challenge root-cause analysis and assess whether our risk profile or risk appetite monitoring needs updatingWe are looking for you who:You’re forward-leaning and self-driven, and you thrive in a dynamic environment. You enjoy being part of a company that builds, changes and optimizes every day, and you bring the seniority to engage others in constructive, risk-focused conversations.In addition, we’re looking for you who hasA university degree in Information Security, Cybersecurity, Computer Science, Engineering, Risk Management or a related field, or equivalent practical experience6+ years of relevant experience in ICT risk management, information security or technology risk, preferably in the financial sectorExperience of independent challenge, oversight or assurance of ICT risk, preferably in a second-line roleStrong technical understanding and the ability to build trust with stakeholdersWorking knowledge of regulatory frameworks such as DORA and EBA/ECB guidanceFluency in English and either Swedish or NorwegianWillingness to travel, for example between Oslo and StockholmIt's a plus if you have experience with, or a strong interest in, AI governance, including the EU AI Act and ISO/IEC 42001It's also a plus if you have basic programming or data skills (for example Python or SQL) that you can use to analyse and automate risk data.To thrive and perform well in the role, we believe that you need to be:leaning forward, thrive in a dynamic and self leadership environment. You need to thrive in a company who are scaling and with that said a company who change, build and optimize on a daily basis. In addition to this, it is important to us that you recognize yourself in our values: we are wholehearted, we collaborate and we take the lead.Have you heard of NOBAVERSE?In our NOBAVERSE, we value openness, trust, and diversity. Here, you can influence your own development and have fun along the way to achieving our goals – all in a workplace that’s a little extra bubbly! ✨Read more about our employee value proposition on our careers page.Read more about how our recruitment process works in the FAQ.We care for your privacy and, with reference to the GDPR, would like to ask you not to include any sensitive personal data in your application, for examples information about ethnic origin, political opinions, religious beliefs or information about your health.Read more about how we handle your personal data here.If you have any questions or concerns about the position, please contact the responsible recruiter.We look forward to receiving your application! 🙏✨