LOD2 Internal Control Consultant – ICT & Cybersecurity

About the role

We are looking for a detail‑oriented LOD2 Internal Control Consultant with deep expertise in ICT, cybersecurity and operational resilience. You will work closely with first‑line control owners, business units and IT operations to test and validate the design and operating effectiveness of critical technical controls across the enterprise.

Key responsibilities

• Execute design and operating effectiveness testing of ICT, information security and operational controls.
• Analyse evidence provided by LOD1 owners and conduct structured walkthroughs to map workflows.
• Prepare comprehensive testing workpapers, document deficiencies and propose remediation actions.
• Support the creation of reporting packages for executive management, audit committees and governance boards.
• Track remediation progress and collaborate with business and IT stakeholders to ensure timely corrective actions.
• Contribute to the continuous improvement of the group’s internal control framework.

Required profile

• Professional experience in internal controls, internal audit, IT audit, risk management or information security within regulated financial services.
• Strong knowledge of internal control frameworks such as COSO.
• Hands‑on experience evaluating IT and security controls against international standards and European regulations (e.g., DORA, NIS2).
• Excellent analytical abilities and stakeholder‑management skills.
• Fluent written and spoken English for international governance reporting.

Required skills

• ISO 27001
• ISO 22301 (BCP/DR)
• NIST Cybersecurity Framework
• CIS Controls
• DORA (Digital Operational Resilience Act)
• NIS2
• COSO internal control framework