Job Summary
- The ICT Risk Officer will be responsible for assessing and
enhancing the organization’s cybersecurity and technology risk posture by
leading the identification and assessment of enterprise-level technology
systems and cybersecurity risks. This includes assessing potential
cybersecurity and technology risks associated with critical business
systems, processes, identifying potential impacts on those systems,
processes, and engaging with diverse stakeholders to develop mitigation
plans where necessary. In addition to coordinating risk assessment
activities, this role will involve developing reports on assessment
results and presenting these results to executives and other stakeholders.
Key Responsibilities
Risk Management
- Implement and oversee the ICT Risk Management
Framework.
- Identify, assess, and design mitigation controls for
risks, monitoring them until closure.
- Conduct system vulnerability tests according to Group
policies and global standards, and provide management with reports on
vulnerabilities and protections against malware and hackers.
- Perform system penetration testing throughout various stages
of system development to ensure system integrity, availability, and
assurance.
- Collaborate with first-line IT teams and business units
to enhance internal control processes related to risks and controls; tech
control library required to meet risk framework objectives.
- Identify, review, and articulate business risks
associated with technical vulnerabilities and IT risks, proposing
improvements and opportunities to support business objectives.
- Test and assess the adequacy and effectiveness of
control structures, providing practical recommendations to enhance control
or process efficiency.
- Monitor and report on IT risk remediation
progress, escalating issues to senior management when necessary.
- Lead or participate in second-line Information
Security and Technology risk management activities, including cyber
security risk assessments, SOC reviews, privacy assessments, technology
selections, implementations, and data analysis.
- Keep abreast with current advances in all areas
of ICT security.
- Maintenance of Group ICT risk dashboards; ICT security
incidents, compliance status of ICT security policies, Key Risk
Indicators (KRIs)
Stakeholder Management
- Collaborate closely with departments such as IT,
compliance, and internal audit to ensure a comprehensive approach to risk
management.
- Engage with external partners and vendors to align their
practices with the organization’s risk management standards.
- Support the implementation of the Group’s Enterprise
Risk Management (ERM) Framework.
- Organize and participate in training and awareness programs
for staff on ICT risks and best practices for risk management, promoting a
culture of security awareness
- REPORTING
- Prepare and present regular reports on the status of ICT risks
and risk management activities to senior management and stakeholders.
- Continuously monitor and report on new and emerging
risks in the ICT landscape.
- Assist the Group Head of Risk and Compliance in preparing
Board Update reports on the ICT control environment.
- Assist in preparing responses to technology-related regulatory
requests and participate in regulatory and external audit reviews.
Requirements
- 5-7 years of Information Security and/or IT Audit experience
with a financial institution, a fin tech company, or a provider to the
financial services
- Bachelor’s degree (or higher) in Computer Science, Information
Systems or related field required
- Master’s degree in Information Systems/Cyber Security
preferred
- CISA, CISM, CISSP, CIA, CRISC, CGEIT certifications are highly
preferred
- Solid understanding of inherent and residual risk management
principles, including experience with control design, operation, and
effectiveness testing.
- Experience in a current knowledge of best practice IT controls
and industry-standard models (e.g., COBIT5, ITIL, NIST) and proven
understanding of regulatory requirements.
- Cloud security experience highly desired
- Expert in security practices, the design of secure systems and
the operation of security processes and technology.
- Subject matter expertise in two or more: DevOps,
microservices, hybrid cloud, network segmentation, AI/ML
Competencies required for the role
- Ability to work unsupervised, exercise leadership, and
influence change.
- Excellent writing and presentation skills.
- Strong change and project management skills, including the
ability to manage time well, prioritize effectively, and handle multiple
deadlines.
- Ability to use independent judgment and discretion when making
majority of decisions.
- Ability to handle confidential and sensitive information with
the appropriate discretion and ethics.
- Ability to engage with management.
- Excellent communication and interpersonal skills / team
player.
- Ability to prepare and facilitate training as a Subject
Matters Expert (SME)
- Good analytical capabilities.
How To Apply
