Head of Information Security Management

General Info

• Department: Information Security & BCM – Group Information Security Management
• Work time Percentage: 100%
• Location: Geneva

Our Company

EFG International is a global private banking group, offering private banking and asset management services. We serve clients in over 40 locations worldwide. EFG International offers a stimulating and dynamic work environment and strives to be an employer of choice. EFG is committed to providing an equitable and inclusive working environment that is founded on the principle of mutual respect. Joining our team means experiencing a supportive environment, where your contributions are valued and recognised. We strongly believe that the diversity of our teams gives us a competitive advantage by fostering better decision-making and greater innovation.

Our Purpose and Mission

Empowering entrepreneurial minds to create value – today and for the future. We are a private bank, offering personalised solutions on a global scale to private and institutional clients. Our sustainable success is based on our talents and on how we partner with our clients and communities to create lasting value.

Job Description

We are looking for a seasonned leader to manage our Group-wide Information Security Management function within the Information Security & BCM organisation. In this role, you will define and maintain the information security governance, risk and compliance framework across all EFG entities, ensuring alignment with applicable ICT and operational resilience regulations (including DORA) and recognised industry standards such as ISO, NIST and COBIT.

Acting as the primary interface to senior management, local CISOs and key governance bodies, you will provide Group-level oversight of information security initiatives, control plans and assurance activities that shape EFG’s medium- to long-term resilience and risk profile. You will lead a team of information security professionals, provide functional direction to local Information Security Officers, and steer major change and transformation programmes in the information security and ICT risk space.

This is a highly visible leadership role, offering the opportunity to influence strategic decisions across multiple entities and jurisdictions and to champion a strong culture of information security and operational resilience across the Group.

Key Responsibilities

• Define and lead the Group information security governance framework, including policies, directives, standards and guidelines, ensuring alignment with regulatory requirements and industry frameworks (ISO, NIST, COBIT) across all EFG entities.
• Integrate and oversee ICT risk management processes, including DORA-driven ICT risk activities, with information security governance so that third-party, data and ICT risks are consistently identified, assessed, mitigated and reported at Group level.
• Steer and monitor the Group information security control plan, including key risk indicators, control certifications and recertifications of special privileges, in close collaboration with ICT Risk Management, to maintain an effective control environment and transparent risk profile.
• Lead major information security change and transformation programmes, such as DORA implementation and ICT risk framework enhancements, ensuring delivery in line with regulatory timelines, Group strategy and the overall information security roadmap.
• Oversee information security–related Third Party Risk Management (TPRM) assessments and ongoing monitoring of security risk exposure, ensuring timely remediation of issues and alignment with the Group TPRM framework owned by the third party risk management and outsourcing function.
• Provide leadership and guidance to local CISOs and Information Security Officers, ensuring consistent application of Group information security policies while accommodating local regulatory and business requirements across multiple jurisdictions.
• Prepare and present regular information security management reporting to senior management and governance bodies (e.g. Information Security Committee), highlighting key risks, control status, incidents, remediation progress and required decisions.
• Act as key contact for internal and external audits on information security management topics, coordinating responses, agreeing remediation plans and tracking closure of findings in partnership with Internal Audit, Compliance and Operational Risk.
• Oversee the portfolio and PMO of information security projects, including planning, prioritisation, progress tracking, dependency management and benefits realisation, ensuring optimal use of resources and alignment with Group priorities.
• Coordinate the information security budget process in collaboration with Finance, including planning, approval and cost tracking for tools, services and external advisory, providing advisory input to the annual budgeting cycle.
• Collaborate closely with IT, ICT Risk Management, Cyber Security Operations, Security Architecture & Project Support, BCM & Resilience, Operational Risk, Compliance and business stakeholders to ensure integrated management of information security and ICT risks.
• Promote a strong risk and security culture across the organisation, communicating complex information security and ICT risk topics in a clear, business-oriented manner to senior management and non-technical stakeholders.

Requirements and Qualifications

Education

• Minimum: Master’s degree in Information Security, Computer Science, Engineering, Risk Management or a related field, or equivalent professional experience.
• Preferred: Advanced degree (Master’s or PhD) in Information Security, Information Risk or a closely related discipline.

Professional Certifications / Licences

• Relevant information security and risk certifications, such as CISSP, CISM, CISA, CRISC, ISO 27001 Lead Implementer / Lead Auditor, or equivalent.

Professional Experience

• Senior information security or ICT risk professional with extensive experience in governance, risk and compliance within the financial services sector, ideally at Group or multi-jurisdictional level.
• At least 15 years of relevant experience in information security, ICT risk or closely related fields, including significant exposure to regulated environments.
• Proven track record in leading cross-functional security initiatives, managing complex regulatory programmes (e.g. DORA, ICT and operational resilience regulations) and interacting with senior management and governance bodies.
• Demonstrated experience in managing and developing teams (3–7 direct reports or similar), as well as providing matrix leadership and functional direction to stakeholders across multiple locations.
• Experience in steering major change and transformation programmes in information security and ICT risk, including project portfolio oversight and budget responsibility or advisory input.

Technical / Functional Knowledge

• Strong knowledge of information security frameworks (e.g. ISO, NIST, COBIT) and ICT / operational resilience regulations, including DORA, and their practical implementation in a regulated financial services environment.
• Deep understanding of ICT risk management, Third Party Risk Management, operational resilience, Business Continuity Management (BCM) and cyber security operations, and how these disciplines integrate into Group information security governance.
• Familiarity with key information security tools and platforms used for control monitoring, risk metrics, assurance activities (e.g. red teaming, cyber table-top exercises, SWIFT/SIC attestations, cyber insurance) and management reporting.
• Strong ability to translate complex technical and risk topics into clear, concise messages for senior management and non-technical stakeholders, enabling informed decision-making on risk and investment.

Languages

• English: Fluent (primary working language).
• Additional languages such as German, French or Italian at business-proficient level are a strong asset.

Our Values

• Accountability: Taking ownership for tasks and challenges, as well as seeking continuous improvement
• Hands-on: Being proactive to rapidly deliver high-quality results
• Passionate: Being committed and striving for excellence
• Solution-driven: Focusing on client outcomes and treating clients fairly with a risk-aware mindset
• Partnership-oriented: Promoting collaboration and teamwork. Working together with an entrepreneurial spirit.