The Apex Group was established in Bermuda in 2003 and is now one of the world’s largest fund administration and middle office solutions providers.
Our business is unique in its ability to reach globally, service locally and provide cross-jurisdictional services. With our clients at the heart of everything we do, our hard-working team has successfully delivered on an unprecedented growth and transformation journey, and we are now represented by over circa 13,000 employees across 112 offices worldwide.Your career with us should reflect your energy and passion.
That’s why, at Apex Group, we will do more than simply ‘empower’ you. We will work to supercharge your unique skills and experience.
Take the lead and we’ll give you the support you need to be at the top of your game. And we offer you the freedom to be a positive disrupter and turn big ideas into bold, industry-changing realities.
For our business, for clients, and for you
Role Purpose
The Information Security Officer is a Luxembourg-based Second Line of Defense role responsible for providing independent oversight, challenge, and assurance over information security, ICT risk, cyber resilience, and technology control practices for European Businesses specially within Luxembourg.
The role supports compliance with applicable regulatory expectations, including DORA, CSSF requirements, Bank of Ireland, internal policies, APEX Group standards, and risk appetite of the businesses. The role provides independent reporting and escalation to local management, governance committees, Group CISO, Regional CISO and Board-level forums, and challenges the design, implementation, remediation, and operating effectiveness of ICT and information security controls.
Key Responsibilities
Provide independent Second Line oversight and challenge of information security, ICT risk, cyber resilience, and technology control practices across Luxembourg entities.
Work together with regional CISO to carry on oversight can control tasks for region for information and cybersecurity resilience.
Review and challenge first-line control design, implementation, control testing results, remediation plans, policy exceptions, and risk acceptances.
Maintain and support the local information security governance framework in alignment with Group policies, local regulatory expectations, and the Bank’s risk appetite.
Perform and document information security and ICT risk assessments, control assurance reviews, thematic reviews, and independent risk opinions.
Support DORA-related oversight activities, including ICT risk management, ICT-related incident management, digital operational resilience testing, and ICT third-party risk oversight.
Oversee and challenge third-party, outsourcing, cloud, SaaS, and critical or important ICT service provider risks, including due diligence, contractual security controls, exit arrangements, concentration risk, and ongoing monitoring.
Support the quality review and maintenance of ICT third-party risk information, including inputs relevant to the DORA Register of Information where applicable.
Provide independent oversight of security incidents, including challenge of impact assessment, root cause analysis, remediation, lessons learned, and escalation decisions.
Monitor and report material information security risks, vulnerabilities, audit findings, regulatory findings, incidents, overdue remediation actions, and accepted risks.
Maintain local information security risk registers, control assurance records, exceptions, risk acceptance documentation, action trackers, and evidence repositories.
Support regulatory and supervisory engagements, including CSSF requests, inspections, thematic reviews, client due diligence, internal audit, and external audit activities.
Prepare and present information security and ICT risk reporting to Authorized Management, Risk Committees, Board meetings, governance forums, client due diligence meetings, and other relevant stakeholders.
Review and contribute to…