Head IT Governance and Risk Asia

GENERAL DESCRIPTION

• IT Governance and Risk Management is a regional function in Asia responsible for technology governance across key pillars and overseeing risk management. This function works to ensure that technology aligns IT functions to support the value of the services. Primary responsibilities include risk management and compliance with applicable laws and regulations.

Aufgaben

• Lead the design, implementation, and ongoing enhancement of the bank's IT enterprise and risk framework, including policies, standards, and procedures. For all key elements of technology architecture, ensuring their efficacy.
• Develop and increase the effectiveness of the bank's IT controls for risk, access management, change management, incident/problem management, and patch management. Develop enhancements and controls to ensure they are responsive as threats evolve, as regulatory environment changes, and to capture lessons-learned from audits, problems, and incidents.
• Own and maintain the risk register. Ensure regular alignment with department heads in the delivery of the product.
• Coordinate and escalate relevant IT risk processes with risk framework, including technology, cybersecurity, compliance, and privacy, while also providing input to governance framework as risk management function.
• Develop and support the definition and execution of effective key risk indicators (KRIs) regularly to identify risks proactively and implement effective controls.
• Liaise with risk auditors in key topics of IT Governance and Risk where assessment activities are required to advise on identified risks and agree on remediation programs.
• Liaise and align IT risk activities with internal and external auditors in the follow-up process to ensure remediation activities are completed and evidenced.
• Partner closely with Information Security Risk to manage compliance with security and regulatory requirements, including PCI-DSS, and any related controls as areas related to the IT team in Asia Pacific.
• Partner with key stakeholders in the Middle East and North Africa (MENA) across the three lines in Asia Pacific, ensuring governance around IT risk and controls in a consistent manner across the region.
• Produce clear report on technology risk related data, trends, and risk indicators.
• Coordinate IT key risk governance dashboards and support for IT risk management programmes, identify risks and manage risk acceptances, including tracking risk remediation.
• Ensure proactive engagement. Develop and enhance relationships with operational resilience, risk management, and IT functions across Asia.
• Lead on testing of operational resilience and capabilities to IT risk activities including the readiness in the event of incidents.
• Develop and operate the cyber-security testing process to identify risks and enhance control and data protection globally.

Anforderungen

• Ensure continuous onboarding of new staff to IT policies and procedures (to further strengthen understanding of policy and procedures, and embed secure practices at a foundational level) and delivery of targeted awareness.
• Demonstrate ability to operate at senior level, aligning senior stakeholders, departments, and driving change across functions.
• Effective communicator with interpersonal and relationship management skills, and with a track record of negotiating, building relationships, and senior engagement/counseling that help convey the risks to the executive team, both verbally and in writing.
• Experience supporting the IT business processes and delivery models, demonstrating professionalism, and stakeholder attitude coupled with business acumen.
• Minimum 10 years experience in IT governance, risk, and audit.
• Excellent and deep understanding of technology risks and controls of modern cloud, hybrid, and on-premises systems and solutions.
• Well-rounded, self-driven individual seeking to make a difference in the banking industry.
• Strong risk domain experience with a strong technological background.
• Proactive and thoughtful problem solver - able to see the big picture, as well as detail.
• Well versed risk domain personnel in the delivery of a larger program and able to report on the issue.
• Data sense and ability to analyze and report data.
• Good risk domain knowledge of IT and security and the regulatory environment (GRC).
• Responsible for the creation of IT risk assessment assessments and operational resilience plans.