Assistant Vice President / Vice President, IT Risk Management

China CITIC Bank International Limited; Hong Kong; Vor Ort; HKD 900.000 - 1.200.000; Vollzeit

Zusammenfassung

China CITIC Bank International Limited seeks a qualified professional to provide oversight of technology and cybersecurity risk management as part of the 2LoD. The role involves challenging 1LoD controls, aligning with regulatory requirements, and driving the risk management framework across IT and business units.

The successful candidate will participate in internal/external audits, risk reporting, and regulatory exercises while promoting a strong risk culture and effective controls in a large

Qualifikationen

• Bachelor-level degree in Information Technology, Information Systems, Risk Management, Computer Science or related discipline.
• 5-8 years of experience in operational risk management, technology risk management or information and cybersecurity risk management.
• CISSP, CISA, CISM, CRISC or other recognized certification is required.

Aufgaben

• Provide oversight and challenge of technology risk management, cybersecurity risk management, and control effectiveness of the 2LoD.
• Respond to changing business, environment, threats, and regulatory requirements.
• Assist to design, maintain and implement the technology risk management framework with ISO27001, NIST 800 and PCI-DSS considerations.
• Identify, monitor, and report operational risk; review controls and risk assessments.
• Ensure 1LoD has appropriate controls; oversee risk assessments and risk-taking activities.

Kenntnisse

English proficiency

Chinese proficiency

Ausbildung

Degree in IT / IS / CS

Jobbeschreibung

Mandatory Reference Checking Scheme (“MRC”) for Hong Kong

The Mandatory Reference Checking Scheme is a framework to facilitate Authorized Institutions (“AIs”) to bilaterally obtain reference information during their recruitment process for certain positions, such that misconduct information in an individual’s previous employments can be provided to AIs to inform their employment decisions. For information related to MRC Scheme, “Frequently Asked Questions for In Scope Individuals” is published by HKAB/Industry Guidelines (https://www.hkab.org.hk/en/home) or further information will be available upon request, if it is applicable to the position(s) applied.

Country of Location: China Hong Kong

Job Responsibilities

• The job holder acts as a second of defence (“2LoD”) and is responsible for providing oversight and challenges of technology risk management, cybersecurity risk management, and control effectiveness of first line of defence (“1LoD”).
• The job holder is also required to respond spontaneously to evolving business, environment, threats, and regulatory requirements.
• Assist to design, maintain and implement the technology risk management framework and ensure key industry standards such as ISO27001, NIST 800, and PCI-DSS are incorporated into the framework.
• Responsible for operational risk identification, response, monitoring, reporting and execution of operational risk framework by reviewing the adequacy of the implemented controls.
• Ensure 1LoD implementing appropriate controls to address identified technology risk, and provide oversights and challenges of 1LoD’s risk assessment and risk-taking activities.
• Provide risk stewardship with appropriate risk management advice to technology and business stakeholders.
• Support technology risk management activities including internal and external audits, new products proposals, project reviews, and regulatory returns and examinations such as C-RAF maturity assessment, iCAST exercise, TM-E-1 and TMG-1 ICA.
• Assist team head to implement the control assurance strategy, methodology, related policies, guidelines and tools in line with regulatory requirements and industrial best practices.
• Conduct assurance reviews on banking operations and IT risks and controls, including understanding relevant control designs, review scoping, control testing, and communication of findings with reviewee teams.
• Perform deep-dive reviews or investigation into OR incidents to identify the root cause(s), provide recommendations to address the control weakness and evaluate the effectiveness of the corrective and preventive actions applied.
• Assist team head in defining and reviewing Risk Appetite and Key Risk Indicators to measure and monitor technology and cybersecurity risk exposure.
• Ensure timely and accurate submission of regular MIS on control assurance related issues to senior management of the Bank.
• Participate in Committees and Meeting as member when required to provide oversights and challenges.
• Prepare the bank-wide awareness or education program to promote the technology and cybersecurity risk cultures in the Bank.

Requirements

• Degree holder preferably in Information Technology, Information Systems, Risk Management, Computer Science, or other relevant discipline.
• 5 - 8 years of working experience in operational risk management, technology risk management, or information and cybersecurity risk management.
• Prior experience in performing assurance reviews and IT audits is preferrable.
• Knowledge of relevant regulatory requirements relating to Operational Risk Management in banking industry.
• Certified in CISSP, CISA, CISM, CRISC or other recognized certificate is a must.
• Self-motivated, independent and able to communicate effectively at all levels.
• Good command of written and spoken English and Chinese (including Putonghua).

中信銀行(國際)有限公司 中信銀行(國際)有限公司（「信銀國際」）是中信集團境外商業銀行業務主要平台，由中信銀行股份有限公司（「中信銀行」）全資子公司中信國際金融控股有限公司（「中信國金」）持有75% 股份。 中信銀行(國際)業務網絡覆蓋香港（21家零售網點、2家商務理財中心及1家私人銀行中心），以及位於美國、新加坡和中國澳門分行，同時通過全資子公司在中國境內提供銀行服務。 自1922年起，中信銀行(國際)與員工、客戶及夥伴一同成長，跨越一個世紀。未來將繼續以「敏捷 專業 化繁為簡」為願景，堅持「文化為本（Culture）、客戶為尊（Customer）、多方聯動（Collaboration） 、科技引領（Cyberspace）」4C核心價值，積極踐行「為客戶謀價值，為員工謀幸福，為股東謀效益，為社會盡責任」的企業使命。 有關中信銀行(國際)的進一步資料，請瀏覽www.cncbinternational.com。

China CITIC Bank International Limited China CITIC Bank International Limited (“CNCBI