Program Manager

As a key member of Scope’s Technology Group, the Program Manager for Operational Security, Risk and Governance will play a pivotal role in safeguarding the integrity, confidentiality, and availability of our systems and data. This position is responsible for driving the operational implementation of security, risk management, and IT governance frameworks across the technology organization. Operating within the regulatory environment of a European credit rating agency, the role demands a strong understanding of financial sector compliance, cybersecurity best practices, and enterprise risk management. The ideal candidate will bring a proactive, structured, and collaborative approach to ensuring Scope’s technology operations remain secure, resilient, and aligned with both internal policies and external regulatory requirements. Duties & responsibilities Operational IT GRC Coordination Coordinate IT GRC (Governance Risk and Compliance) activities across the IT organization to support effective day-to-day execution of security controls and incident response. Ensure alignment of operational practices with internal policies and regulatory requirements. Regulatory and DORA Compliance Implementation Drive the operational implementation of DORA (EU Regulation 2022/2554) and other technology regulatory requirements across Scope’s technology teams and landscape. Maintain and coordination operational implementation of Scope’s operational DORA procedures in line with DORA’s five pillars: risk management, incident reporting, resilience testing, third-party risk, and information sharing  Risk and Governance Oversight Identify, assess, and mitigate ICT-related risks within the Technology Group, ensuring risks are documented, escalated, and addressed appropriately. Maintain and enforce IT governance frameworks, policies, and procedures, ensuring compliance with internal standards and external regulations. Collaborate and serve as interface between technology  with second and third lines of defence (e.g., Risk, Compliance, Internal Audit) to ensure effective risk management and control assurance. Stakeholder Engagement and Reporting Act as the primary point of contact for operational security matters within the Technology Group. Provide regular reporting to senior management, risk committees, and regulators on the status of ICT risk, incidents, and compliance. Support internal and external audits, regulatory reviews, and supervisory engagements. Professional & personal qualifications A university degree in Cyber Security, Computer Science, Information Systems, Risk Management, or a related field Experience in IT security, risk management, or governance Proven experience implementing and operationalizing regulatory frameworks such as DORA, NIS2, or GDPR Strong background in incident response, vulnerability management, and operational resilience testing. Deep understanding of cybersecurity frameworks (e.g., DORA, ISO 27001, etc). Familiarity with financial sector regulations and supervisory expectations (e.g., ESMA, BaFin, etc). Knowledge of third-party risk management and secure supply chain practices. Demonstrated ability to lead cross-functional teams and manage complex projects under regulatory scrutiny. Strong interpersonal and communication skills, with the ability to engage effectively with senior stakeholders, auditors, and regulators. Fluent in English; German language is a plus. Interested? If this sounds like a journey for you, we look forward to learning more from your convincing application. Please note: For non-EU applicants, a valid work and residence permit is a prerequisite for this job position. Unfortunately, we are unable to sponsor relocation from outside of the EU at this time. What we want to see Current CV Copy of your university degrees and certificates Criminal record certificate (can be provided at a later date) At least 3 letters of reference (can be provided at a later date) About Scope With more than 250 employees operating from offices in Berlin, Frankfurt, London, Madrid, Milan, Oslo and Paris, Scope Group is the leading European provider of independent credit ratings, ESG and fund analysis. Based on forward-looking and innovative methodologies, Scope offers a European perspective that contributes to greater diversity of opinion for institutional investors worldwide. Scope Ratings is the largest European credit rating agency, registered in accordance with EU and UK rating agency regulation, offering opinion-driven and non-mechanistic credit risk analysis. Scope ESG Analysis provides tools for analysing and reporting on ESG impact and risk, as well as second-party opinions on green, social and sustainable bonds. Scope Fund Analysis rates more than 10,000 funds and asset managers across all major asset classes.  At Scope Group, we are committed to fostering a diverse and inclusive workplace where everyone is treated with respect and fairness. We embrace people from all backgrounds, regardless of culture, ethnicity and gender. We ensure that our application processes are free from discrimination. By valuing each individual's unique background and perspectives, we strive to create an environment where all employees can thrive and contribute their best. Our dedication to equality and inclusivity reflects our belief that diversity drives innovation and success.