Third Parties Audit Lead

At ING Hubs Spain we are looking for a Third Parties Audit Lead

We are looking for a talented and enthusiastic Third Party Audit Lead to join our Tech Hub Spain Team of Third Party Cyber Risk Management.

The responsibility of this team is to perform onsite inspections worldwide with focus on ING 3rd parties that support critical processes. We are a group of curious team‑players IT auditors that enjoy addressing new challenges related to third party vulnerabilities and IT risks.

As a Third Party Audit Lead, you will lead a team of IT Auditors to execute onsite inspections on behalf of ING to third parties. You will plan, organise, and execute risk‑based onsite audits, coordinate with senior management/supplier to arrange fieldwork and assess the control environment via interviews, review of documentation, field inspections, configuration assessment and technical tests, including penetration tests and/or red teaming for critical third parties.

At the end of each audit you will provide executive‑ready dashboards, communicate systemic risk insights and results to management that helps ING improve its security control environment and mitigate risks across third parties. Travel may be required with an estimated 6‑8 weeks per year.

• Bachelor’s or master’s degree in Computer Science, IT Engineering, IT Security, IT Risk Management or IT Audit.
• Technical (security) knowledge of IT technologies: operating systems, network infrastructure, database management systems, web technologies, mobile operating systems, and expertise in one or more IT areas such as cloud technologies, programming development processes, identity access management, container technologies, or web/mobile applications.
• More than 6 years of experience in IT Audit with knowledge of IT risk management, governance and the three‑lines of defence model.
• Experience managing a team.
• Strong vendor negotiation and stakeholder management skills.
• Ability to translate technical gaps into business impact language.
• Experience performing penetration tests or red teaming exercises.
• Strong knowledge of IT processes and standards, best practices such as COBIT, ISO 27001, ISO 22001.
• Comfortable leading both technical and IT process audits, managing conflicts and expectations, and organising fieldwork testing to meet timelines.
• Coaching team members and helping them grow.
• Fluent English for communication and writing, and comfortable working in multicultural environments.
• Certifications in good standing such as CISA, CISSP, OSCP or ISO
  27001LA.
• Additional plus:
  Knowledge of banking regulations (PSD2, EBA guidelines, DORA, NIST CSF, ISO/IEC 27001, SOC 2, Cloud Security Frameworks, EU regulatory frameworks); experience with vulnerability assessment and pentesting tools (Nessus, Wireshark, Burp, Kali); experience with data analytics tools or scripting (e.g., Knime).

• Flexible work model; determine which days you work at home and which you attend ING Madrid.
• Restaurant card.
• On‑site facilities: electric mobility solutions, doctor, hairdresser, gym, concierge services.
• Health insurance for you and family.
• Life insurance.
• Flexible remuneration model with tax‑advantaged benefits such as nursery, transport card, and training aids.
• Transport allowance.
• Pension plan available after 1 month.