Technology Risk Management, Principal

AIA Malaysia; Kuala Lumpur; On-site; MYR 180,000 - 300,000; Full time

Job summary

AIA Malaysia seeks a senior technology risk professional to identify, evaluate and report on technology risks in regulatory and group contexts. You will manage risk assessments, attestations and dashboards, partnering with the business to ensure compliance with policies.

Responsibilities include monitoring external threats, defining KRIs and risk appetite, and delivering clear reports to senior leaders and the board. Expertise in NIST/COBIT/ISO27001 and Power BI is essential.

Qualifications

• Bachelor's degree in Information Technology, Computer Science, Cybersecurity or related field.
• Minimum 8 years working experience with at least 10 years of experience in technology security risk and control that involves regulatory environment.
• Proven knowledge of risk analysis methodologies, frameworks, standards (NIST, COBIT, ISO27001).
• Experience in building Risk Dashboards using Power BI and writing DAX functions.

Responsibilities

• Manage the regular and project technology risk assessment, attestation and reporting.
• Manage on-going engagements and partner with the business to support technology risk assessment and monitoring.
• Identify and act upon opportunities to improve Technology Risk Governance processes and framework.
• Monitor the external threat environment for emerging technology and cyber threats and advise the relevant business on the appropriate course of action.
• Regular reporting on the current status of the technology risk program to senior business leaders and the board.

Skills

Risk management

Regulatory compliance

Stakeholder management

Communication

Independent work

Data visualization

Education

Bachelor's degree in IT / CS / Cybersecurity or related field

Tools

Power BI

DAX

Microsoft Power Platform

Job description

The position is responsible for identifying, evaluating and reporting on technology risks in a manner that meets regulatory, group, management and other compliance requirements. The incumbent works proactively with the various business units and other internal departments and organizations to implement practices that meet the regulatory, Group’s and Company’s defined guidelines, risk policies, standards and/ or procedures.

Roles and Responsibilities:

• Manage the regular and project technology risk assessment, attestation and reporting.
• Manage on-going engagements and partner with the business to support technology risk assessment and monitoring.
• Identify and act upon opportunities to improve Technology Risk Governance processes and framework.
• Ensure that technology programs are meeting the applicable local laws, regulations and policies to minimize or eliminate the risk and compliance.
• Monitor the external threat environment for emerging technology and cyber threats and advise the relevant business on the appropriate course of action.
• Proactively identify risks through monitoring of technology performance in risk and compliance management.
• Regular reporting on the current status of the technology risk program to senior business leaders and the board of directors as part of a strategic enterprise risk management program.
• Assist in the definition of the business’s operation & technology risk appetite statements and monitor Key Risk Indicators (KRIs) against overall enterprise risk appetite.
• Develop visually accessible reports and dashboards for various internal & external audiences that enable risk monitoring.
• Continuously improve and/or enhance the analysis and reporting system by soliciting feedback from stakeholders.

Job Requirements:

• Bachelor's degree in Information Technology, Computer Science, Cybersecurity or related field.
• Minimum 8 years working experience with at least 10 years of experience in technology security risk and control that involves regulatory environment.
• Evolving knowledge in several of the following areas: Insurances services, information technology, information security, cyber security, digital transformation, and technology management.
• Professional certifications like CISA, CISM, CEH, CISSP will be advantageous.
• Practical knowledge of risk analysis methodologies, frameworks, standards, and best practices (NIST, COBIT, ISO27001).
• Ability to work independently while sharing expertise with others.
• Strong communication and stakeholder's management skills.
• Experience in full developing of Risk Dashboards using Microsoft Power BI.
• Experience to use various sources to pull data into and writing DAX functions in Power BI to achieve reporting needs.
• Knowledge of the automation process using MS Power or other automation tools is required.