Manager Cyber Security Governance and Controls (m/f)
HSBC Continental Europe, Luxembourg S.A.E. · Luxembourg (Luxembourg), Luxembourg ·
- Category
- Security
At HSBC, we're a trusted international organisation with a global customer base of around 39 million customers worldwide through a network that covers 62 countries and territories. In Europe, our ambition is to become the leading international wholesale bank and we need talent like you to help us meet our ambition. Whether you want a career that could take you to the top or in an exciting new direction-we offer opportunities, support and rewards that will take you further.
The HSBC Group in Luxembourg is a significant employer and operates several businesses including asset management, securities services, private banking and corporate banking.
By joining us, you'll help evolve and grow our IT function.
What you will do:
Reporting to the Head of IT and Cyber Security, you will support HSBC's Luxembourg operations by managing day-to-day cyber security governance and ICT control oversight. You will monitor the effectiveness of cyber/ICT controls, drive remediation of issues, and provide clear reporting to senior stakeholders. You will also support audit and regulatory engagement and contribute to operational resilience activities where cyber and ICT risks affect critical or important business services.
In this role, you will (but not limited to):
• Monitor and assess the effectiveness of cyber security and ICT controls (including maintaining appropriate documentation and evidence).
• Identify control gaps and weaknesses, agree remediation plans with control and process owners, and track actions through to closure.
• Support cyber/ICT risk activities such as risk identification, assessment, treatment tracking and reporting, working with Risk/Compliance oversight teams.
• Produce governance reporting, dashboards and committee materials (control effectiveness, issues, metrics and key risk themes).
• Coordinate responses to audit and regulatory requests, ensuring timely and high-quality evidence and management responses.
• Contribute to operational resilience activities where cyber/ICT risks impact critical or important services (e.g., recovery readiness tracking and follow-up).
• Drive continuous improvement in governance processes, reporting quality, and control monitoring (including standardisation and automation where appropriate).
You should apply if you have:
Essential experience and capabilities
• Experience in cyber security governance, ICT risk management and/or control oversight in a regulated environment (financial services preferred).
• Knowledge of recognised security and control frameworks (e.g., ISO/IEC 27001, NIST CSF, CIS Controls).
• Strong stakeholder management skills and the ability to challenge constructively and influence without formal authority.
• Excellent written and verbal communication skills, including producing senior/committee-grade materials.
• Strong planning and prioritisation skills; the abillity to manage multiple deadlines with high attention to detail.
• Fluency in English required; French and/or German is an advantage.
Desirable
• Familiarity with Luxembourg/EU regulatory expectations for ICT and cyber risk (including DORA and relevant CSSF circulars).
• Understanding of operational resilience concepts and how cyber/ICT risk affects critical services.
• Experience with GRC / issue tracking / evidence management tools (e.g., Archer, ServiceNow, Jira, SharePoint or equivalent).
• Certifications such as CISSP, CISM, CCSP, CRISC (or equivalent).
Even if you feel you do not meet 100% of our qualifications, we encourage you to apply, if you believe this role is right for you.
What you'll get in return:
The pay range for this role is EUR 96,200 - 110,000.
HSBC operates multiple variable pay plans, to reflect the diverse nature of the businesses, roles and markets in which we operate. Variable pay is designed to reward colleagues for their individual performance and contribution, as well as the performance of their relevant Business / Infrastructure, and the overall Group.
We offer a comprehensive and competitive package of benefits usually covering health support, life assurance, pension, and family friendly leaves, as well as many other benefits to support your wellbeing.
HSBC has been certified “Top Employer 2026” in Europe. This recognition from the Top Employers Institute rewards our HR practices and recognises HSBC as an HR Leader in France, Germany, Italy, Ireland, Luxembourg, The Netherlands, Poland and Spain.
If you're looking for a career where you will be respected as an individual and valued for the contributions you make, please visit our career page, and discover how diversity drives our success.
Being open to different points of view is important for our business and the communities we serve. At HSBC, we're dedicated to creating diverse and inclusive workplaces. We are committed to removing barriers and ensuring careers at HSBC are inclusive and accessible for everyone to be at their best. If you have a need that requires accommodations or changes during the recruitment process, please let us know.
Please note that every selected candidate will have to provide us with a valid criminal record check in due time.
Personal data held by the Bank relating to employment applications will be used in accordance with our Privacy Statement, which is available on our website. For any GDPR request, please send it to: [email protected]
For further information on building your career at HSBC, please visit: www.hsbc.com/careers
Discover how ‘We Value Difference'.
The HSBC Group in Luxembourg is a significant employer and operates several businesses including asset management, securities services, private banking and corporate banking.
By joining us, you'll help evolve and grow our IT function.
What you will do:
Reporting to the Head of IT and Cyber Security, you will support HSBC's Luxembourg operations by managing day-to-day cyber security governance and ICT control oversight. You will monitor the effectiveness of cyber/ICT controls, drive remediation of issues, and provide clear reporting to senior stakeholders. You will also support audit and regulatory engagement and contribute to operational resilience activities where cyber and ICT risks affect critical or important business services.
In this role, you will (but not limited to):
• Monitor and assess the effectiveness of cyber security and ICT controls (including maintaining appropriate documentation and evidence).
• Identify control gaps and weaknesses, agree remediation plans with control and process owners, and track actions through to closure.
• Support cyber/ICT risk activities such as risk identification, assessment, treatment tracking and reporting, working with Risk/Compliance oversight teams.
• Produce governance reporting, dashboards and committee materials (control effectiveness, issues, metrics and key risk themes).
• Coordinate responses to audit and regulatory requests, ensuring timely and high-quality evidence and management responses.
• Contribute to operational resilience activities where cyber/ICT risks impact critical or important services (e.g., recovery readiness tracking and follow-up).
• Drive continuous improvement in governance processes, reporting quality, and control monitoring (including standardisation and automation where appropriate).
You should apply if you have:
Essential experience and capabilities
• Experience in cyber security governance, ICT risk management and/or control oversight in a regulated environment (financial services preferred).
• Knowledge of recognised security and control frameworks (e.g., ISO/IEC 27001, NIST CSF, CIS Controls).
• Strong stakeholder management skills and the ability to challenge constructively and influence without formal authority.
• Excellent written and verbal communication skills, including producing senior/committee-grade materials.
• Strong planning and prioritisation skills; the abillity to manage multiple deadlines with high attention to detail.
• Fluency in English required; French and/or German is an advantage.
Desirable
• Familiarity with Luxembourg/EU regulatory expectations for ICT and cyber risk (including DORA and relevant CSSF circulars).
• Understanding of operational resilience concepts and how cyber/ICT risk affects critical services.
• Experience with GRC / issue tracking / evidence management tools (e.g., Archer, ServiceNow, Jira, SharePoint or equivalent).
• Certifications such as CISSP, CISM, CCSP, CRISC (or equivalent).
Even if you feel you do not meet 100% of our qualifications, we encourage you to apply, if you believe this role is right for you.
What you'll get in return:
The pay range for this role is EUR 96,200 - 110,000.
HSBC operates multiple variable pay plans, to reflect the diverse nature of the businesses, roles and markets in which we operate. Variable pay is designed to reward colleagues for their individual performance and contribution, as well as the performance of their relevant Business / Infrastructure, and the overall Group.
We offer a comprehensive and competitive package of benefits usually covering health support, life assurance, pension, and family friendly leaves, as well as many other benefits to support your wellbeing.
HSBC has been certified “Top Employer 2026” in Europe. This recognition from the Top Employers Institute rewards our HR practices and recognises HSBC as an HR Leader in France, Germany, Italy, Ireland, Luxembourg, The Netherlands, Poland and Spain.
If you're looking for a career where you will be respected as an individual and valued for the contributions you make, please visit our career page, and discover how diversity drives our success.
Being open to different points of view is important for our business and the communities we serve. At HSBC, we're dedicated to creating diverse and inclusive workplaces. We are committed to removing barriers and ensuring careers at HSBC are inclusive and accessible for everyone to be at their best. If you have a need that requires accommodations or changes during the recruitment process, please let us know.
Please note that every selected candidate will have to provide us with a valid criminal record check in due time.
Personal data held by the Bank relating to employment applications will be used in accordance with our Privacy Statement, which is available on our website. For any GDPR request, please send it to: [email protected]
For further information on building your career at HSBC, please visit: www.hsbc.com/careers
Discover how ‘We Value Difference'.