LOD2 Internal Control Consultant – ICT & Cybersecurity

About the role

We are looking for a detail‑oriented LOD2 Internal Control Consultant with a strong background in ICT, cybersecurity and operational resilience. The consultant will work closely with first‑line owners, business units and IT operations to test and validate the design and operating effectiveness of critical technical controls.

Key responsibilities

• Execute design and operating effectiveness testing of key ICT, information security and operational controls.
• Analyse technical evidence provided by LOD1 owners and conduct structured walkthroughs to map workflows.
• Prepare comprehensive testing workpapers, document deficiencies and propose remediation actions.
• Support the creation of reporting packages for executive management, audit committees and governance boards.
• Track remediation actions and collaborate with business and IT stakeholders to ensure timely implementation.
• Contribute to the continuous improvement of the organisation’s internal control framework.

Required profile

• Professional experience in internal controls, internal audit, IT audit, risk management or information security within regulated financial services.
• Deep knowledge of internal control frameworks such as COSO.
• Hands‑on experience evaluating IT and security controls against international standards and European regulations (e.g., DORA, NIS2).
• Proven ability to perform control testing, evidence verification and technical report drafting.
• Excellent analytical abilities and strong stakeholder‑management skills.
• Fluent written and spoken English.

Required skills

• ISO 27001
• ISO 22301
• NIST Cybersecurity Framework
• CIS Controls
• DORA (Digital Operational Resilience Act)
• NIS2
• COSO internal control framework