Your role in the team

• The Chief Security Office (CSO) is responsible for developing, maintaining, and implementing the Deutsche Bank Group's information security strategy. The CSO manages the measures derived from this strategy and advises employees on identifying, developing, implementing, and executing all processes aimed at reducing information security risks, responding to incidents, and establishing appropriate guidelines and standards for information security management.
• The CSO Central Embedded Risk Team (“ERT”) is part of the CSO organization and is located within the CSO Third Party, Regulatory, Risk & External Engagement and CISO EMEA & Germany Team (TREE & CEG). The role's primary objective is to drive the risk and control agenda, which translates into supporting, facilitating, managing, and monitoring all aspects of information security risks. This includes coordinating internal and regulatory audits, supporting findings management, and risk reporting. The ERT works daily with all stakeholders across the CSO departments.
• Every year, CSO participates in statutory and regulatory audits. The aim of these audits is to assess the adequacy and effectiveness of internal IT controls in the area of ​​Identity & Access Management: They coordinate external audit activities within CSO and act as the point of contact during the audit cycles.
• They analyze and translate complex audit requirements; they proactively seek clarifications or escalate if the requirements do not clearly match.
• They regularly prepare internal CSO reports on audit progress and outstanding tasks and provide support in the effective handling of audit requests.
• They regularly inform the head of the ERT about the current status and relevant developments.
• They work with the CSO ERT Lead on further improvement activities, including discussions with various stakeholders, such as senior management.
• They build and maintain strong, cooperative relationships with key stakeholders both inside and outside of CSO.

Our expectations of you

Education

• Completed studies in computer science/business informatics or comparable qualification; relevant certifications (e.g. CISSP, CISM, CRISC, CISA, CCSP) are an advantage.

Qualifications

• Very good understanding of cybersecurity standards (e.g. ISO 27001, NIST, ITIL) and regulatory requirements in the financial sector (e.g. BAIT, SOx, MAS, cybersecurity guidelines).
• A clear understanding of the relationship between IT risks and their impact on business processes, as well as strong analytical, problem-solving, communication (at all hierarchical levels) and teamwork skills in an international environment.
• Fluent English required, German an advantage.