Lead, Risk Ops

Standard Chartered; Kuala Lumpur; On-site; MYR 300,000 - 480,000; Full time

Benefits offered by this job

Inclusive and values-driven culture

Competitive salary and benefits

Retirement savings and life insurance

Generous leave (annual, parental, sabb

Flexible working options

Wellbeing and resilience support

Continuous learning and development

Job summary

Standard Chartered seeks a senior security leader to drive Sustainability Operations within WRB CISO, covering sTK and SIA. You will develop strategies to mitigate security risks and ensure confidentiality, integrity, and availability across systems and data.

You will standardize processes across cluster CISOs, manage remediation timelines, and report on risk posture. The role involves governance over SIA, exceptions, and ongoing risk assessment to safeguard critical assets.

Qualifications

• Proven expertise in cyber security controls including IC controls.
• Strong leadership and stakeholder management abilities.
• Hands-on experience with vulnerability management and remediation oversight.
• Perform security risk assessments and define mitigating controls.

Responsibilities

• Review and approve security exceptions and renewals with justified risk acceptance.
• Collaborate with CISO and OTCR process owners to improve SIA and exception management.
• Support transition of SIA/exception processes to Azure DevOps (ADO).
• Identify design-phase security gaps and enforce remediation per IC standards.
• Oversee annual penetration testing for internet-facing systems and critical assets.
• Lead continuous improvements of IC workflows (ADO, SNC, SIA, exception management).
• Drive vulnerability management programs and secure-by-design culture.

Skills

Cyber Security & IC Controls

Leadership & Stakeholder Management

Vulnerability Management

Security Risk Assessment

Education

Degree holder

Security certifications (CISSP, CISA, CISM, CRISC, PCI-QSA, CSX)

Job description

Job Summary

• Lead for the Sustainability Operations pillar of WRB CISO, covering sTK, SIA.
• Support the development and implementation of strategies to mitigate security risks and ensure the confidentiality, integrity, and availability of our systems and data.
• Drive standardization across cluster CISOs, ensuring aligned execution of Group practices for SIA review, STK review, exception management processes, and ERR TP Action Plans.
• Identify security gaps during the design phase with the domain architects and enforce mandatory remediation plans for any deviation from IC standards.
• Comprehensive vulnerability management tracking and reporting across all operational and executive risk forums to ensure unified visibility into WRB security posture.
• Review and analyse security control exceptions, determine the residual risk, and define appropriate mitigating controls.
• Negotiate and diligently track remediation timelines for identified security control deficiencies.
• Contribute to the evaluation and implementation of new security tooling and innovative approaches.
• Actively participate in the design and enhancement of SIA and exception management workflows and reporting dashboard.
• Generate and present a comprehensive monthly exception report to CISO, detailing status, remediation progress, missed commitments and perpetual exceptions.

Key Responsibilities

• Review and approve security exception renewals, including those escalated by the CIO, ensuring continued justification and risk acceptance.
• Collaborate with other CISO and OTCR process owners to drive continuous improvement in SIA and exception management processes.
• Support the transition of SIA and exception management processes to Azure DevOps (ADO)
• Identify security gaps during the design phase with the domain architects and enforce mandatory remediation plans for any deviation from IC standards.
• Support project business objectives by enabling project releases while ensuring a clear understanding and acceptance of any introduced risks.
• Support the development and implementation of strategies to mitigate security risks and ensure the confidentiality, integrity, and availability of our systems and data.
• Collaborate with security leadership, engineering, and compliance to execute security strategies
• Execute the SIA review process and exercise authority to block vulnerable releases that violate IC standards or exception management.
• Drive the residual risk assessment of residual vulnerabilities that cannot be remediated immediately and alignment of residual risk rating with OTCR for endorsement.

Additional Responsibilities

• Mandate and oversee the annual penetration test for internet-facing system and crown jewels, ensuring all findings are fixed or formally accepted before go-live.
• Support the Threat and Governance Team in risk assessment, reporting and forming of the RC update / risk papers / management updates.
• Lead the continuous process improvements of IC workflows (e.g.: ADO, SNC, SIA, exception management, execution discipline, risk assessment).
• Build and drive high-performing vulnerability management and secure by design team, fostering a culture of continuous upskilling.
• Review and analyse security control exceptions, determine the residual risk, and define appropriate mitigating controls.
• Negotiate and diligently track remediation timelines for identified security control deficiencies.
• Contribute to the evaluation and implementation of new security tooling and innovative approaches.
• Actively participate in the design and enhancement of SIA and exception management workflows and reporting dashboard.
• Review and analyse security control exceptions, determine the residual risk, and define appropriate mitigating controls.
• Is accountable for governing and sustaining group-managed risks on SIA across WRB application estate. The role ensures controls are implemented as designed, remain effective, and are supported by accurate, current control-status information.

Motivations

• Excellent organisation and leadership skills with ability to manage multiple deadlines and effectively prioritise. Continuously upskill to remain current with the cyber threats and security of WRB Business.

Skills and Experience

Must-have Skills

• Cyber Security & IC Controls
• Leadership & Stakeholder Management
• Vulnerability Management
• Security Risk Assessment

Other Skills

• Process Improvement & Problem Management
• Change & Programme Management
• Stakeholder Management & Collaboration

Qualifications

Key Experiences

• ICS experience especially in banking industry
• Technical IC skills
• Managing team

Certifications / Qualifications

• Degree holder
• Possess one or more security certifications such as CISSP, CISA, CISM, CRISC, PCI-QSA, CSX etc.
• Technical certifications

Languages

• English

About Standard Chartered

We’re a global bank connecting clients to our differentiated network, offering growth opportunities in the world’s most dynamic markets. Our strategy, which combines cross-border capabilities and leading wealth management expertise, helps us deliver our purpose - to drive commerce and prosperity through our unique diversity.

Over our 170-year history, and across a unique geographical footprint connecting Asia, Africa and the Middle East to each other and the world, we’ve built a bank like no other, with diverse capabilities and partnerships that set us apart.

What We Offer

• Being part of an inclusive and values driven organisation, one that embraces and celebrates our unique diversity, across our teams, business functions, and geographies.
• In line with our Fair Pay Charter, we offer a competitive salary and benefits to support your mental, physical, financial and social wellbeing.
• Core bank funding for retirement savings, medical and life insurance, with flexible and voluntary benefits available in some locations.
• Time-off including annual leave, parental/maternity (20 weeks), sabbatical (12 months maximum) and volunteering leave (3 days), along with minimum global standards for annual and public holiday, which is combined to 30 days minimum.
• Flexible working options based around home and office locations, with flexible working patterns.
• Proactive wellbeing support through Unmind, a market-leading digital wellbeing platform, development courses for resilience and other human skills, global employee assistance programme, sick leave, mental health first-aiders and self-help toolkits.
• A continuous learning culture to support your growth, with opportunities to reskill and upskill and access to physical, virtual, and digital learning.

Visit our careers website to learn more about us: www.sc.com/careers.