Lead, Risk Ops

Standard Chartered Plc; Kuala Lumpur; Hybrid; MYR 210,000 - 320,000; Full time

Benefits offered by this job

Inclusive culture

Fair pay benefits

Retirement & insurance

Annual leave & sabbatical

Flexible working

Wellbeing support

Continuous learning

Job summary

Standard Chartered Plc is seeking a senior security leader to oversee Sustainability Operations under the WRB CISO. You will drive risk mitigation, vulnerability management, and governance across domain CISOs while ensuring alignment with IC standards and Azure DevOps transitions.

The role emphasizes collaboration with security leadership, engineering, and compliance to execute security strategies and maintain a strong security posture across the organization.

Qualifications

• ICS experience especially in banking industry.
• Technical IC skills and ability to manage teams.
• Strong risk assessment and remediation capabilities.

Responsibilities

• Review and approve security exceptions and renewals with risk justification.
• Collaborate with CISO and OTCR process owners to improve SIA/exceptions.
• Support transition of SIA/exception processes to Azure DevOps.
• Identify security gaps in design and enforce remediation per IC standards.
• Lead vulnerability management and reporting across risk forums.
• Design and enhance SIA workflows and reporting dashboards.
• Oversee annual penetration testing and ensure fixes or acceptances.
• Coordinate remediation timelines for identified deficiencies.

Skills

Cyber Security & IC Controls

Leadership & Stakeholder Management

Vulnerability Management

Security Risk Assessment

Education

Degree holder

Job description

• Lead for the Sustainability Operations pillar of WRB CISO, covering sTK, SIA.
• Support the development and implementation of strategies to mitigate security risks and ensure the confidentiality, integrity, and availability of our systems and data.
• Drive standardization across cluster CISOs, ensuring aligned execution of Group practices for SIA review, STK review, exception management processes, and ERR TP Action Plans.
• Identify security gaps during the design phase with the domain architects and enforce mandatory remediation plans for any deviation from IC standards.
• Comprehensive vulnerability management tracking and reporting across all operational and executive risk forums to ensure unified visibility into WRB security posture.
• Review and analyse security control exceptions, determine the residual risk, and define appropriate mitigating controls.
• Negotiate and diligently track remediation timelines for identified security control deficiencies.
• Contribute to the evaluation and implementation of new security tooling and innovative approaches.
• Actively participate in the design and enhancement of SIA and exception management workflows and reporting dashboard.
• Generate and present a comprehensive monthly exception report to CISO, detailing status, remediation progress, missed commitments and perpetual exceptions.

Key Responsibilities

• Review and approve security exception renewals, including those escalated by the CIO, ensuring continued justification and risk acceptance.
• Collaborate with other CISO and OTCR process owners to drive continuous improvement in SIA and exception management processes.
• Support the transition of SIA and exception management processes to Azure DevOps (ADO)
• Identify security gaps during the design phase with the domain architects and enforce mandatory remediation plans for any deviation from IC standards.
• Support project business objectives by enabling project releases while ensuring a clear understanding and acceptance of any introduced risks.
• Support the development and implementation of strategies to mitigate security risks and ensure the confidentiality, integrity, and availability of our systems and data.
• Collaborate with security leadership, engineering, and compliance to execute security strategies
• Execute the SIA review process and exercise authority to block vulnerable releases that violate IC standards or exception management.
• Drive the residual risk assessment of residual vulnerabilities that cannot be remediated immediately and alignment of residual risk rating with OTCR for endorsement.

• Mandate and oversee the annual penetration test for internet-facing system and crown jewels, ensuring all findings are fixed or formally accepted before go-live.
• Support the Threat and Governance Team in risk assessment, reporting and forming of the RC update / risk papers / management updates.
• Lead the continuous process improvements of IC workflows (e.g.: ADO, SNC, SIA, exception management, execution discipline, risk assessment).
• Build and drive high-performing vulnerability management and secure by design team, fostering a culture of continuous upskilling.
• Review and analyse security control exceptions, determine the residual risk, and define appropriate mitigating controls.
• Negotiate and diligently track remediation timelines for identified security control deficiencies.
• Contribute to the evaluation and implementation of new security tooling and innovative approaches.
• Actively participate in the design and enhancement of SIA and exception management workflows and reporting dashboard.
• Review and analyse security control exceptions, determine the residual risk, and define appropriate mitigating controls.
• Is accountable for governing and sustaining group-managed risks on SIA across WRB application estate. The role ensures controls are implemented as designed, remain effective, and are supported by accurate, current control-status information.

Motivations

• Excellent organisation and leadership skills with ability to manage multiple deadlines and effectively prioritise. Continuously upskill to remain current with the cyber threats and security of WRB Business.

Skills and Experience

Must-have Skills

• Cyber Security & IC Controls
• Leadership & Stakeholder Management
• Vulnerability Management
• Security Risk Assessment

Other Skills

• Process Improvement & Problem Management
• Change & Programme Management
• Stakeholder Management & Collaboration

Qualifications

Key Experiences

• ICS experience especially in banking industry
• Technical IC skills
• Managing team

Certifications / Qualifications

• Degree holder
• Possess one or more security certifications such as CISSP, CISA, CISM, CRISC, PCI-QSA, CSX etc.
• Technical certifications

Languages

• English

We're a global bank connecting clients to our differentiated network, offering growth opportunities in the world's most dynamic markets. Our strategy, which combines cross-border capabilities and leading wealth management expertise, helps us deliver our purpose - to drive commerce and prosperity through our unique diversity.

Over our 170-year history, and across a unique geographical footprint connecting Asia, Africa and the Middle East to each other and the world, we've built a bank like no other, with diverse capabilities and partnerships that set us apart.

What We Offer

• Being part of an inclusive and values driven organisation, one that embraces and celebrates our unique diversity, across our teams, business functions, and geographies.
• In line with our Fair Pay Charter, we offer a competitive salary and benefits to support your mental, physical, financial and social wellbeing.
• Core bank funding for retirement savings, medical and life insurance, with flexible and voluntary benefits available in some locations.
• Time-off including annual leave, parental/maternity (20 weeks), sabbatical (12 months maximum) and volunteering leave (3 days), along with minimum global standards for annual and public holiday, which is combined to 30 days minimum.
• Flexible working options based around home and office locations, with flexible working patterns.
• Proactive wellbeing support through Unmind, a market-leading digital wellbeing platform, development courses for resilience and other human skills, global employee assistance programme, sick leave, mental health first-aiders and self-help toolkits.
• A continuous learning culture to support your growth, with opportunities to reskill and upskill and access to physical, virtual, and digital learning.

Visit our careers website to learn more about us: www.sc.com/careers.