Information Technology Risk Manager

KAF Group; Kuala Lumpur; On-site; MYR 180,000 - 240,000; Full time

Job summary

KAF Group is seeking an experienced 2LoD Risk Manager to oversee technology risk across governance, risk management and cyber resilience. You will review risk assessments, challenge incidents, and ensure reporting to senior management and the board.

You will develop and maintain the Technology Risk Management Framework (TRMF) and Cyber Resilience Framework (CRF), monitor KRIs on outages, threats, patching, and capacity, and ensure policy alignment with regulatory expectations.

Responsibilities

• Reviewing and challenging the 1LoD’s risk self-assessments (RCSA), project risk assessments, and incident root-cause analyses.
• Developing, maintaining, and updating the Technology Risk Management Framework (TRMF) and Cyber Resilience Framework (CRF).
• Defining, monitoring, and reporting KRIs related to IT outages, cyber threats, patch management, and system availability to senior management and the Board Risk Committee.
• Ensuring all IT and cybersecurity policies align with internal risk appetite statements and regulatory expectations.
• Reviewing mandatory regulatory assessments, such as the Technology Risk Assessment (TRA) for new digital services or cloud adoptions.

Job description

• Independent Challenge: Reviewing and challenging the 1LoD’s risk self-assessments (RCSA), project risk assessments, and incident root-cause analyses.
• Risk Oversight & Governance: Developing, maintaining, and updating the Technology Misk Management Framework (TRMF) and Cyber Resilience Framework (CRF).
• Key Risk Indicators (KRIs): Defining, monitoring, and reporting KRIs related to IT outages, cyber threats, patch management, and system availability to senior management and the Board Risk Committee.
• Policy Compliance: Ensuring all IT and cybersecurity policies align with both internal risk
• appetite statements and regulatory expectations.

RMIT Pillar / Focus Area 2LoD Risk Manager's Role

Governance & Framework

Ensuring the board and senior management receive objective, accurate reports on tech risk. Verifying that a robust Technology Risk Management Framework (TRMF) is active.

Technology Risk Management

Overseeing the identification and assessment of emerging technology risks (e.g., Cloud, AI, API integrations) before deployment.

Cyber Health & Resilience

Challenging the effectiveness of the Cyber Defence Centre (SOC), vulnerability assessments, and penetration testing schedules.

Technology Operations

Monitoring critical system uptime, patch management backlogs, and capacity planning exceptions.

Structured Assessments

Reviewing mandatory regulatory assessments, such as the Technology Risk Assessment (TRA) for new digital services or cloud adoptions.