Technology and Cyber Risk Governance Lead

Confidential; Petaling Jaya; On-site; MYR 180,000 - 300,000; Full time

Job summary

Confidential is seeking an experienced Cyber Risk governance professional to own the second line function (2LoD) in technology and cyber risk. The role will develop and maintain risk frameworks, policies, and standards, and drive adherence across the organisation.

You will engage with regulators, coordinate audits, and lead technology risk reporting while collaborating with technology, data and product teams to manage key risks for management committees.

Qualifications

• Degree in Computer Science or technology-related field.
• 8–10 years in a second or third line role at a regulated financial institution or TechFin/Fintech.
• Direct exposure to or interaction with financial regulators is preferred.
• Strong English communication and stakeholder management skills.

Responsibilities

• Oversee second line technology and cyber risk governance in line with regulatory requirements.
• Develop and maintain cyber risk frameworks, policies and standards.
• Promote adherence to security policies and standards across the organisation.
• Manage technology and cyber regulatory obligations and report material non-conformities.
• Lead risk reporting (KRI) and ensure alignment with risk appetite.
• Collaborate with business and technology teams to track key risks and provide updates to risk committees.
• Engage in audits and regulatory examinations focusing on technology and cyber risks.
• Coordinate with Procurement, Legal, Data Governance, Compliance and Data Protection Officers to embed cyber security in contracts.

Education

Degree in Computer Science or technology-related field

Job description

• Responsible for second line function (2LoD) in technology and cyber risk governance.
• Develop and maintain the cyber risk frameworks, policies and standards based on prevailing regulatory requirements and industry best practices.
• Promulgate and drive adherence with the framework, security policies and standards.
• Actively maintain technology and cyber regulatory obligations to ensure continued compliance, as well as track and report material non-conformities and potential breaches.
• Drive and oversee technology and cyber KRI reporting activities and to ensure adherence with the risk appetite.
• Serve as a subject matter expert to business and technology teams on technology and cyber risk matters.
• Lead and / or take part in technology and cyber risk governance working groups and/or committees.
• Engage in internal and external audits, as well as regulatory examinations/inspections, with focus on technology and cyber risks.
• Drive collaboration with 1LoD stakeholders including Technology, Data and Product teams to track and manage key risks and issues on a regular basis, and to provide periodic management updates to the relevant Risk committees.
• Support regulatory incident reporting to the authorities upon confirmation of relevant incidents.
• Provide constructive challenge to post-mortem root cause analysis to ensure adequacy and efficacy of remedial or risk treatment plans to prevent recurrence.
• Conduct independent testing of IT and Cybersecurity Controls as part of periodic RCSA requirements.
• Uplift technology and cyber risk awareness through various educational and employee engagement channels.
• Responsible for overseeing third party security risk assessments of the org third parties and partners.
• Work with internal stakeholders including Procurement, Legal, Data Governance, Compliance and Data Protection Officers to ensure integration of mandatory information and cyber security requirements in the contracts with service providers.

The must-haves:

• Degree in Computer Science or Technology-related field.
• Minimum 8-10 years experience in a similar second or third line role with another regulated financial institution or TechFin / Fintech firms.
• Relevant and direct exposure or interaction with financial regulators is preferred.
• Solid, articulative verbal and written skills with proficiency in English.
• Stakeholder management skills such as negotiation and conflict management skills.