Head of Cyber Exposure & Assurance (all humans)

Make a difference in the financial life of millions of people: At Erste Digital you are co-creating the digital future, in which better financial health is possible. #believeinyourself

We are part of Erste Group – the largest banking group in Central and Eastern Europe with more than 2,500 branches and over 45,000 employees. Our more than 2,000 IT experts and enthusiasts are the bank's Digital Muscle.

Help shape the next generation of Cyber & Information Security at Erste Digital

We are evolving our security organization around clear missions, accountable services and stronger collaboration across domains. As Head of Department, you will shape the capability together with your teams and peers rather than inherit a fixed organizational blueprint. You will be accountable for outcomes, people leadership, service maturity and cross-Group value.

Your Mission

Shape the capabilities that make cyber exposure visible, help stakeholders choose appropriate security treatments and provide evidence that protections work against realistic attack techniques.

What you will shape and be accountable for

• Set direction for exposure discovery, prioritization, monitoring, security advisory and validation activities.

• Turn large volumes of technical findings combined with compliance gaps and architectural debt into context, priorities and practical remediation guidance for technology owners.

• Help stakeholders choose appropriate treatment when security trade-offs, exceptions or residual exposure require explicit management judgement.

• Use offensive testing and responsible disclosure to validate controls through realistic testing and feed evidence back into architecture and operations.

• Build trusted relationships with business & technology owners and help teams move from findings to practical remediation rather than simply reporting weaknesses.

Group first - Built to scale beyond one entity

• Think Group First: design every capability so it can be consumed across the Group where feasible, or at minimum produce reusable blueprints, patterns, standards and lessons that create value beyond Erste Digital.

• Seek alignment with Group Security and relevant entities before creating local-only solutions where a shared approach is realistic.

• Balance local delivery responsibility with the ambition to simplify, standardize and scale security capabilities across the Group.

What success looks like

• Technology owners receive prioritized, actionable exposure information instead of unfiltered finding lists.

• Complex security questions are supported by clear options, trade-offs and transparent residual exposure.

• Important controls and services are regularly validated through realistic testing and external disclosure channels.

• Exposure and assurance approaches can be reused by Group entities, with common blueprints, prioritization models and testing patterns.

Who benefits from your work

Technology owners, product teams, management, sourcing teams, assurance functions and Group entities benefit from clearer priorities, better-informed choices and credible evidence that protections are effective.