Third Party Risk Management Specialist

Lunar is a Nordic challenger bank building the future of financial life with AI at the core. Our engineers, designers, and product

people work on problems that actually matter. Making money simpler, smarter, and more rewarding for over a million registered

users across the Nordics.

As our new Third Party Risk Management Specialist you'll join Legal & First Line Risk in Aarhus, reporting to our Director of

Legal & First Line Risk. You'll own third party risk across the vendor lifecycle, working closely with procurement, with ICT third

party risk under DORA at the centre of the job. Most of what Lunar buys is technology, so DORA's rules are the rulebook for most

of this role, with the EBA guidelines covering the rest.

Procurement owns sourcing, price and negotiation. You own the risk and sit alongside procurement rather than inside it, so the

risk view stays independent of the deal: assessing what the risk is and what the contract needs to say before we sign, then

tracking whether the vendor delivers, whether the risk has changed, and whether we could exit if we had to.

• Assess before we sign. Run risk-based classification, due diligence and risk assessments as part of procurement, with a sharp

eye for ICT services that support critical or important functions, including cloud, subcontracting chains and where our data

sits.

• Set the contract requirements. Turn the risk picture into contract requirements together with Legal, including DORA Article 30

terms, SLAs, audit rights and exit rights, and support the business in negotiations.

• Follow up after we sign. Track performance against SLAs, run vendor reviews with business owners, follow ICT incidents,

assurance reports such as ISAE 3402 and SOC 2, and security test results, and reassess when something changes.

• Keep the register and exit plans right. Own the DORA register of information and our ICT concentration risk input, and make

sure ICT services supporting critical or important functions have exit strategies that would actually work.

• Be the go-to person for third party risk. Report to management, answer to 2nd line, internal audit and the Danish FSA, and

improve the process while you run it.

• 3-5 years of experience in vendor management, contract management, outsourcing, procurement or third party risk, with a large

share of it on ICT or technology vendors, ideally in a bank, payment institution or other regulated company.

• A background in law, business, contract management or vendor management, for example cand.merc.jur. or a similar combination,

or equivalent practical experience.

• A working knowledge of DORA's ICT third party risk requirements and the EBA outsourcing guidelines, or solid experience from

another regulated sector and the drive to master them quickly.

• You read a contract and spot what's missing, you've managed vendors after the signature as well as before it, and you have

enough technical understanding to talk to engineers about cloud, SaaS, subcontracting and data location, including judging what

an assurance report does and does not cover.

• A strong writer who's comfortable challenging vendors, business owners and senior stakeholders. Fluent in English; Danish or

another Scandinavian language is a strong plus.

• 4 days in the office. We're a team that builds together, thinks together, and moves together. Showing up is part of how we

work.

• State of the art equipment. The newest computer, monitor, mouse, and keyboard. We want you to do your best work without

anything slowing you down.

• Pension, health insurance, and enhanced parental leave. From your financial future to your family moments. We've got you

covered.

While you hold on tight for us to get back to you, curious to see what we’re up to? Follow us on LinkedIn for business

announcements and releases 📢, check out our Instagram for an inside scoop on what it’s like to work here .

Depending on the regulations in the country where you will be employed, we will ask to see or obtain information about your

criminal record. Please note that our employment is conditional upon you not being registered in RKI (Ribers Kredit Information).

We welcome applications from candidates of all backgrounds. If you need any adjustments during the recruitment process, please let

us know