Deputy Executive Manager, IT Risk and Controls

Global Sports Jobs Limited; Hong Kong; On-site; HKD 1,000,000 - 2,000,000; Full time

Benefits offered by this job

Dynamic working environment

Competitive benefits package

Development opportunities

Job summary

Global Sports Jobs Limited seeks a first-line risk leader for the IT Division to set the strategy for technology risk management and drive enterprise-wide governance. The role focuses on maturing the ITRC function and partnering with risk, audit, compliance, and security teams to elevate risk management as a strategic capability.

You will lead and mentor a team of risk professionals, translate appetite into practical guidance, and oversee risk governance across IT initiatives and transformations.

Qualifications

• Bachelor's degree required in a relevant discipline.
• 15+ years in technology or operational risk with leadership experience.
• Executive-level experience with C-suite or board interaction.
• Expert knowledge of risk frameworks (COBIT, NIST, ISO 27001/27005, ITIL).
• Proven ability to translate risk appetite into actionable guidance.

Responsibilities

• Define and deliver the multi-year ITRC strategy aligned with IT objectives and risk appetite.
• Lead governance forums and coordinate with Enterprise Risk, Internal Audit, Compliance, and IT Security.
• Mentor Senior Technical Managers and risk analysts, building capability and succession plans.
• Embed risk into investment, vendor, and architectural decisions with audit coordination.
• Champion risk-by-design across Agile and product delivery lifecycles.

Skills

Executive communication

Stakeholder management

Technology risk frameworks

Strategic leadership

Risk governance

Cloud/DevOps/CI-CD risk

Data governance & analytics

Education

Bachelor's degree in a relevant discipline

Master's degree or MBA in a relevant discipline

Tools

GRC platforms

Job description

About the Role

The role is the first-line risk leader for the IT Division, reporting to the Head of Department. It sets the strategic direction for technology risk management, drives enterprise-wide risk governance, and ensures the organisation's risk posture keeps pace with rapid technological change, regulatory evolution, and business ambition. It is accountable for key portfolios of the IT Risk & Controls (ITRC) function, the maturity of its capabilities, and its reputation as a trusted, value-adding partner to the business. The ITRC Department establishes and maintains a robust risk management methodology that identifies, assesses, and mitigates IT and technology risks, aligning with the Enterprise Risk Management Framework and the Technology Risk Management Framework and working closely with business units. The role provides leadership and mentoring for the team, maintains strategic alignment for the function, and elevates technology risk from a compliance necessity to a strategic capability.

Key Responsibilities

• Define and deliver the multi-year ITRC strategy aligned with the Club's IT strategic objectives and enterprise risk appetite, and co-develop the IT Division's risk framework with Enterprise Risk to translate board-level appetite into actionable technology tolerances.
• Anticipate emerging risk themes such as AI/ML governance, third-party ecosystem risk, digital ethics, and regulatory change, and support innovation within the risk function through automation, data-driven risk sensing, and integration with engineering toolchains.
• Serve as a trusted risk voice at senior IT leadership and cross-divisional governance forums, chairing or co-chairing the Technology Risk Forum (TRF) and representing ITRC at the Technology Risk & Information Security Committee (TRISC).
• Present the IT risk posture, key themes, and strategic trade-offs to the IT Executive Committee and, where required, enterprise risk and audit committees.
• Ensure governance structures are decision-oriented and connected to real operational signals, and drive executive accountability for risk ownership across IT leadership by embedding risk into strategic planning, investment decisions, and transformation programmes.
• Lead, mentor, and develop Senior Technical Managers, risk analysts, and control specialists, defining team structure, capability roadmap, and succession planning, setting quality standards for assessments, control evaluations, and reporting, and fostering a culture of continuous improvement
• Intellectual curiosity, and constructive challenge.
• Partner with Enterprise Risk, Internal Audit, Compliance, and Information Security to align frameworks, taxonomies, and reporting, and act as senior liaison to second-line and third-line functions, coordinating audit responses, regulatory engagements, and assurance activities.
• Embed risk into portfolio-level investment, vendor selection, and architectural decisions, and translate incidents, near-misses, and audit findings into systemic improvements beyond single-issue fixes.
• Ensure transformation risk coverage across delivery risk, operational readiness, control migration, and residual exposure, and advise programme steering committees on risk-based sequencing, go/no-go decisions, and contingency planning.
• Champion risk-by-design across Agile and product-centric delivery lifecycles.

Required Experience & Qualifications

• Bachelor's degree in a relevant discipline.
• 15+ years in technology or operational risk, with 5+ years in senior leadership owning functional strategy and teams.
• Proven track record of building, scaling, or transforming a technology risk or controls function.
• Significant experience operating at the executive level, including C-suite, steering committees, or board-facing forums.
• Expert knowledge of technology risk frameworks, control design, and operational resilience standards such as COBIT, NIST, ISO 27001/27005, and ITIL.
• Depth across cyber, operational resilience, data governance, third-party risk, and change/transformation risk.
• Success in complex, matrixed organisations such as financial services, regulated, or membership-based contexts.
• Advanced use of GRC platforms and risk analytics, positioning them as insight engines rather than repositories.
• Fluency in modern technology landscapes such as cloud, DevOps/CI-CD, microservices, data platforms, and AI/ML, including their risk profiles.
• Exceptional executive communication, with the ability to create board-ready narratives and visuals.
• Outstanding stakeholder management and influence with senior technology and business leaders.
• Executive-calibre risk leadership with deep technology fluency and gravitas to influence at the highest levels, combining big-picture thinking with operational credibility and experience building and leading risk functions.
• Ability to translate enterprise risk appetite into practical technology risk guidance and navigate complex stakeholder landscapes across IT, business, and assurance.
• Capacity to make judgement calls under uncertainty, balancing rigour with pragmatism, and to lead through influence, building coalitions and driving change without positional authority.
• Strategic vision to define a compelling future state, mobilise the team to deliver, and maintain alignment with the Club's strategy.

Preferred Skills

• Master's degree or MBA in a relevant discipline.
• Senior certifications such as CRISC, CISM, CISA, ISO 31000 Lead Risk Manager, or equivalent.
• Active industry involvement.

Salary

Competitive salary

Benefits & Perks

• Competitive benefits package.
• Dynamic working environment.
• Development opportunities.

About the Company

We are an equal opportunity employer and strive to create an inclusive workplace for all, welcoming applicants from diverse backgrounds.