Vice President, GR NFRM TRM - Technology Architecture Advisory

CIMB; Kuala Lumpur; On-site; MYR 180,000 - 260,000; Full time

Job summary

CIMB in Kuala Lumpur seeks an experienced Technology Risk professional to provide independent second-line oversight of the Bank's Technology Resilience framework. You will evaluate critical systems, third-party dependencies, and DR/testing outcomes to strengthen resilience and regulatory alignment.

Ideal candidates have 7–12 years in technology risk or information security, with CRISC/CISSP/CISM certifications and banking experience, plus a track record delivering governance papers and risk

Qualifications

• Bachelor's degree or higher in information technology, engineering, risk management or related discipline.
• Professional certifications: CRISC, CISSP or CISM are preferred.
• 7–12 years' experience in technology risk, risk governance, operational risk or information security.
• Experience in a banking or regulated financial services environment is preferred.

Responsibilities

• Provide independent second-line technology risk oversight and advisory for the Bank's Technology Resilience framework.
• Review resilience risks, recovery capabilities, RTO/RPO/MTD, and testing outcomes to ensure objectives are met.
• Monitor compliance with resilience policies, risk appetite, and regulatory requirements while reporting key risks and remediation actions.
• Prepare governance papers for senior management and Board committees; support governance initiatives.

Skills

Technology risk

Risk governance

Operational risk

Information security

Education

Bachelor's Degree in Information Technology / Engineering / Risk Management

CRISC

CISSP

CISM

Job description

• Provide independent second-line technology risk oversight, challenge, and advisory for the Bank's Technology Resilience framework.
• Ensure critical technology services, systems, infrastructure, and third-party dependencies supporting Critical Business Services (CBS) are resilient and recoverable.
• Ensure alignment with the Bank's risk appetite, operational resilience objectives, and regulatory requirements.
• Support the Bank's ability to prevent, withstand, respond to, and recover from technology disruptions.
• Strengthen the Bank's overall operational resilience and business continuity capabilities.

Key Responsibilities:

• Advise stakeholders on the design, implementation, and governance of the Technology Resilience framework.
• Support identification of critical systems and technology services supporting Critical Business Services (CBS).
• Contribute to technology risk appetite setting and end-to-end dependency mapping.
• Provide independent risk oversight for disruption prevention, response, recovery, and resilience strategies.
• Review dependency mapping and assess operational resilience vulnerabilities.
• Ensure technology disruption risks are adequately identified and managed.
• Oversee and challenge the mapping of applications, infrastructure, data flows, integrations, and third-party providers supporting CBS.
• Review and challenge the management of critical dependencies and concentration risks.
• Ensure alignment with technology risk appetite, business resilience objectives, and regulatory expectations.
• Provide oversight of DR governance, recovery objectives, failover/failback strategies, and resilience-by-design practices.
• Review DR testing outcomes across on-premises, hybrid, and cloud environments.
• Provide oversight and challenge of resilience and DR testing programs.
• Assess severe but plausible disruption scenarios (e.g., data centre outages, ransomware, cloud failures, critical application failures).
• Review test effectiveness, recovery outcomes, lessons learned, and remediation actions to strengthen resilience.

Job Specification:

• Provide independent oversight of technology resilience, disaster recovery, dependency mapping, and recovery planning activities.
• Review resilience risks, recovery capabilities, impact tolerances (RTO, RPO, MTD), and testing outcomes to ensure resilience objectives are met.
• Monitor compliance with resilience policies, risk appetite, and regulatory requirements while reporting key risks and remediation actions.
• Education qualification: Bachelor's Degree in Information Technology, Engineering, Risk Management, or a related discipline.
• Professional certification: Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Security Professional (CISSP) or Certified Information Security Manager (CISM)
• Preferably within Banking or a regulated financial services environment.
• 7 - 12 years' experience in technology risk, risk governance, operational risk, or information security.
• Experience across First Line and Second Line roles.
• Technology Risk, Compliance, Audit, and Risk Governance.
• Exposure to third-party risk, operational risk, and fraud-related matters.
• Experience preparing governance papers for senior management and Board committees.
• Project management experience supporting governance or risk initiatives.