DORA ICT Risk & Operational Resilience Consultant

Daily tasks

• Interpret DORA ICT risk management and digital operational resilience requirements in a financial-services context
• Translate DORA requirements into practical control expectations and assessment criteria
• Perform requirements-to-controls mapping across policies, processes, systems, and governance arrangements
• Conduct DORA gap assessments covering current-state maturity, compliance gaps, risks, and remediation recommendations
• Assess control design effectiveness and, where applicable, operating effectiveness
• Review and challenge stakeholder evidence for completeness, relevance, traceability, and sufficiency
• Apply quality assurance to evidence records, control evaluations, gap statements, and final reporting
• Lead workshops, interviews, and working sessions with business, technology, risk, compliance, internal audit, and third-party management stakeholders
• Facilitate decision-making, manage actions, and communicate findings to senior stakeholders
• Produce assessment workpapers, control matrices, gap registers, remediation roadmaps, and management presentations
• Deliver a quality-assured DORA gap assessment, final report, and executive summary

Requirements

• Hands-on experience with DORA, particularly ICT risk management and digital operational resilience requirements
• Strong understanding of ICT risk, IT governance, operational resilience, third-party ICT risk, incident management, and testing requirements within financial institutions
• Proven experience conducting regulatory or control-framework gap assessments and requirements-to-controls mapping
• Practical experience assessing control design effectiveness and operating effectiveness
• Experience in evidence review, assurance reviews, and quality assurance
• Experience working in Nordic or broader European financial services, including banks, insurers, pension funds, asset managers, or regulated financial infrastructure providers
• Ability to translate regulatory requirements into pragmatic control requirements and remediation actions
• Strong workshop leadership and stakeholder facilitation skills with technical and non-technical audiences
• Excellent written and verbal English communication skills

Nice to have

• Familiarity with EBA Guidelines, NIS2, ISO 27001, COBIT, ITIL, BCM/ISO 22301, or relevant local financial supervisory expectations
• Background in technology risk, IT audit, operational resilience, risk advisory, compliance, or internal controls
• Relevant certification such as CISA, CRISC, CISSP, ISO 27001 Lead Auditor/Implementer, COBIT, or similar

Must have: DORA, ICT Risk