Hiring in regulated financial services is no longer just about finding someone who knows a platform, a rulebook or a programming language. Employers also need people who can keep critical services running when technology, providers or processes fail.

That challenge is particularly relevant to Forex and CFD brokers, payment businesses, investment firms and FinTech companies that rely on trading platforms, cloud infrastructure, liquidity connections, payment service providers and outsourced technology. The EU’s Digital Operational Resilience Act (DORA) has applied since 17 January 2025 to financial entities within its scope. In October 2026, the European Supervisory Authorities (ESAs) identified digital operational resilience and oversight of critical ICT providers among their priorities for 2027 [1][2].

For recruiters and hiring managers, the practical question is simple: how do you identify candidates who can turn regulatory expectations into reliable day-to-day operations?

1. Define the operational problem before writing the job description

A vacancy headed ‘DORA Specialist’ or ‘ICT Risk Manager’ may attract candidates with very different backgrounds. Before advertising, identify the actual gaps: incident coordination, supplier assessments, business continuity testing, access controls, technology governance or board reporting.

For a brokerage, those gaps may concern the trading bridge, CRM, client portal or liquidity-provider connections. For a payments firm, they may involve PSP outages, reconciliation delays, data dependencies or critical integrations. The EBA explains that DORA’s register of information is intended to support monitoring and supervision of ICT third-party risk [3].

Hiring action: write three measurable outcomes for the first six months—for example, improve the ICT supplier inventory, run a realistic outage exercise, or establish a clearer incident escalation workflow. State which business functions the hire must work with.

2. Look for evidence of real incidents, not just policy knowledge

A candidate may know the terminology of resilience without having handled an operational disruption. Ask for a concrete example: What happened? Which service was affected? Who made the decisions? How were customers and management informed? What changed afterward?

The ESAs’ September 2026 operational instructions on DORA incident reporting emphasise data quality and consistent reporting practices. Those instructions are supervisory support material rather than a new legal interpretation [4]. This makes accurate documentation and disciplined communication particularly useful capabilities to test.

Hiring action: use a short scenario. ‘Your client portal is unavailable during a volatile market, while your cloud provider gives no recovery time. Walk us through your first 30 minutes.’ Score candidates on prioritisation, escalation, communication, evidence and recovery—not on whether they recite an idealised checklist.

3. Assess third-party risk and commercial judgment together

Many regulated firms depend on external providers for essential functions. A strong hire should understand how to evaluate service criticality, concentration risk, contract dependencies, access to information and workable contingency options. ESMA notes that EU-level oversight of critical ICT providers complements, rather than replaces, each financial entity’s own responsibility to manage ICT risks [5].

Technical specialists need not be lawyers, and compliance professionals need not be engineers. However, both should know when to involve Legal, Procurement, Information Security, Operations and senior management.

Hiring action: ask candidates to explain how they would review a proposed technology vendor supporting a critical business service. Look for a balanced answer that covers risk, cost, operational feasibility, contractual protections and ongoing monitoring.

4. Build cross-functional teams instead of searching for a single “unicorn”

Operational resilience is a shared responsibility. Compliance may interpret obligations, Technology may implement controls, Operations may own recovery procedures, Legal may review contracts, and leadership remains accountable for decisions within its remit.

Rather than demanding every skill from one person, map the capabilities already available internally. A smaller brokerage may benefit more from a pragmatic ICT Risk and Governance Manager supported by external technical specialists than from an unrealistic all-in-one vacancy.

Hiring action: separate must-have experience from trainable skills. For example, hands-on incident coordination and the ability to work with stakeholders may be essential, while familiarity with a particular vendor tool can be learned. Give interview panels representatives from the functions the new hire will support.

5. Use practical assessments and a realistic onboarding plan

Credentials, regulatory exposure and prior job titles are useful screening signals, but they do not prove that someone can improve resilience in your organisation. Keep assessments proportionate and relevant to the actual job.

A concise case exercise could ask an applicant to prioritise three weaknesses: an undocumented cloud dependency, an outdated recovery test and unclear incident ownership. Strong candidates should explain the trade-offs, identify missing information and propose sensible first steps.

Hiring action: plan onboarding around access to system owners, current supplier records, incident logs, business continuity documentation and relevant management committees. Set 30-, 60- and 90-day objectives and check that the new hire can influence the teams responsible for implementation.

Conclusion

DORA is not simply a recruitment keyword. It is part of a wider shift towards demonstrating that financial businesses can understand, withstand and recover from technology disruption. The ESAs’ 2027 priorities reinforce the continued supervisory attention to resilience [1].

The strongest hiring process therefore tests practical judgment, cross-functional collaboration and evidence of execution. Employers that define the problem clearly and assess real-world capability are better placed to build resilient teams without over-specifying roles.

Recruit with FXCareer.eu

Recruiting for Compliance, Risk, Technology, Operations, Payments, Dealing, Finance or senior leadership? FXCareer.eu supports employers across Forex, CFD, FinTech and regulated financial services. Visit FXCareer.eu to discuss your hiring requirements and find relevant candidates.

Sources and further reading

1. European Banking Authority — European Supervisory Authorities set priorities for 2027 (13 October 2026)
2. European Banking Authority — Preparations for reporting of DORA registers of information
3. European Banking Authority — DORA registers of information: purpose and reporting resources
4. European Banking Authority — DORA Incident Reporting: Operational Instructions (16 September 2026)
5. ESMA — DORA Oversight framework