PKA seeks an experienced IT governance specialist

PKA seeks experienced ICT governance specialist

Make our ICT risks measurable and our supplier management coherent

You will have three areas of responsibility. You will quantify PKA’s ICT risks so management can prioritise efforts and set risk tolerance. You will professionalize the governance of our ICT suppliers. And you will ensure solid, ongoing reporting to the executive, risk committee, audit committee and the board. DORA provides the framework, but the goal is more than compliance. We want a setup that works in practice and gives a clear picture of PKA’s risks, dependencies and actions.

You will be part of a small team in Finance, ICT and Tax and report to the Deputy Director. There is a short path from your work to the decisions it supports.

The first year: two strategic initiatives

Make ICT risks concrete

• Establish a credible ICT risk register
• Assess the security level through interviews and selected tests
• Estimate probabilities and financial consequences
• Incorporate the method into the policy for operational risks, and prepare it for the Risk Committee
• Contribute to setting risk tolerance thresholds, and translate the results into reporting for management and the board

It’s not about making uncertain conditions artificially precise. It’s about a transparent and technically solid method that leads to better decisions on risk, security and investments. You will gain experience with quantitative ICT risk management used for prioritisation.

Further development of supplier management in the PKA community

Today, a large part of the overview is not system-supported. You must

• Update the DORA gap analysis, prioritise actions and ensure that the requirements are supported by relevant policies, business processes, SLAs and controls
• Quality-assure supplier assessments – criticality, due diligence, risk assessment and exit plan – for both Forca suppliers and those with whom PKA itself enters into agreements
• Develop the existing procurement flow further so the process for relevant assessments of new ICT suppliers is optimised and business-oriented from the start
• Create an annual cycle for assessments, control testing and reporting
• Ensure ongoing follow-up on agreed service requirements and supervision of suppliers

The aim is a coherent process for the entire supplier lifecycle, from the first procurement request to a potential exit.

Reporting that equips the management

In addition to the two initiatives, you will be responsible for ongoing reporting on ICT risks, information security, digital operational resilience and outsourcing. It should give management a real basis for decision and answer:

• What ICT risks are the most significant?
• How likely are they, and what could they cost?
• Which suppliers and technologies are we most dependent on?
• Do the controls meet our requirements?
• Which risks do we accept?

You translate complex technical material into understandable terms without losing nuances. You stand up for the material when it is discussed by the executive, Risk Committee, Audit Committee and Board, in close collaboration with the Deputy Director.

You execute and challenge

A significant portion of PKA’s ICT operations and security work is performed by Forca. PKA is responsible, sets the requirements and supervises. We set requirements and monitor Forca’s technical and organizational security measures, e.g., access control, logging, patch and vulnerability management, and you evaluate the results of control tests, vulnerability assessments and emergency drills. You prepare analyses, risk assessments, processes, settings and reporting yourself. You coordinate with Forca, the business, Legal and Governance as well as Risk Management and Compliance.

It requires you to be able to present technically justified requirements and engage in technical dialogue. You must be able to assess controls and documentation and follow up on action plans and deviations so the work moves forward without undermining collaboration. The Deputy Director sets the direction together with you. You drive the tasks from the first analysis to the solution that will work in daily operations.

You have experience translating regulation into operations

You have worked with ICT risk management, ICT audit, information security, ICT compliance or ICT supplier management in a regulated organisation. Your background can be legal, financial, technical or something else.

What you need from day one

• Experience with DORA or equivalent requirements for ICT risks and outsourcing in the financial sector.
• Experience with ICT risk management, e.g., risk assessments, control design or control testing.
• Experience with reporting on ICT risks, operational resilience or outsourcing to management and the board
• Experience with assessing and following up on outsourcing suppliers, risk assessment, due diligence, SLA follow-up and preferably exit plans
• Technical understanding sufficient to challenge suppliers and evaluate their documentation
• A relevant advanced degree

Experience from a pension fund, an insurance company, a bank or another regulated company is an advantage. The pension industry is not a requirement. You can learn PKA’s operational model in the role.

Knowledge of ISO 27001/27005 or NIST CSF is a plus. The same goes for certifications such as CISM, CRISC, CISA, CISSP or ISO 27001 Lead Implementer/Auditor.

What you should be able to do as a person

We know we’re looking for a person who can translate DORA requirements into a control, decipher an SLA, pose the right technical questions to Forca and then explain it all to a five-slide board. You don’t need to be an expert in everything. But you should enjoy that broad range being the fun part.

You won’t have a team to delegate to – but a multitude of competent partners. You write the analysis yourself, build the process yourself and stand up when it has to be defended.

You must quantify risks where there is no right answer. That means you must be able to justify a judgment and explain how you arrived at it, even when someone presses you. You do not own the operation. That lies with Forca. Your role is to set the requirements, hold fast to them and assess whether the delivery is good enough. If you’d rather be hands-on with the technical work yourself, this is not the place.

If you nod in recognition, we’d love to hear from you

Send CV and application no later than 15 November 2026. Tell us about your motivation and the experiences you will draw on in working with PKA’s ICT risk management and ICT suppliers. Please provide a brief example of how you translated a complex regulatory requirement into a solution that worked in practice.

Application deadline: 15 November 2026

Department: Tuborg Boulevard 12 2900 Hellerup

Location: Hellerup