Head of Cyber Risk Governance

Tawteen; Muscat; On-site; OMR 60,000 - 90,000; Full time

Job summary

Tawteen is seeking a Head of Cyber Risk Governance to lead the Second Line of Defence cyber governance program. You will define enterprise risk methodologies, maintain the Unified Control Library, and ensure alignment with regulatory requirements.

This role oversees risk appetite, policy ownership, and governance forums at a senior level. Ideal candidates have extensive experience in cyber risk governance within financial services, strong regulator engagement history, and a Bachelor’s degree in

Qualifications

• 15+ years in cyber/technology risk governance within financial services.
• Experience in non-financial risk management and regulatory compliance.
• Track record engaging with regulators.
• Experience establishing governance structures and committees.

Responsibilities

• Defines and maintains risk frameworks, service risk taxonomy, and methodologies.
• Oversees cyber risk appetite, tolerances, and breach handling.
• Owns policy creation, approval, and exception management frameworks.
• Manages UCL governance and related policy frameworks.
• Performs horizon scanning and monitors regulatory changes.
• Monitors compensating controls and escalates high-risk issues.
• Supports risk committees and governance services scheduling.
• Provides methodology and tooling enablement for 1LOD risk assessments.
• Facilitates control objective clinics to align 1LOD–5LOD understanding.
• Ensures QA for 2LOD activities.

Skills

Cyber risk governance

Policy development

Security management

Regulatory engagement

Governance & committee facilitation

Education

Bachelor's degree in Information Technology / Computer Science

CISA certification

CISSP or CISM advantageous

Knowledge of ISO 27001 and NIST CSF

Tools

ISO 27001

NIST CSF

Job description

Department Protective Services Unit Risk Management Department

Main Role Overall accountability The Head of Cyber Risk Governance is primarily accountable for operating cyber governance within the Second Line of Defence 2LOD This includes driving the definition and maintenance of the Bank s cyber governance system risk methodology and Unified Control Library UCL as well as ensuring the cyber framework aligns with enterprise risk management and regulatory requirements

Principal Accountabilities

• Defines and maintains the Tech Cyber Enterprise Risk Framework Service risk taxonomy and methodologies e g risk thresholds impact likelihood scales
• Facilitates the setting and maintenance of the Cyber Risk Appetite amp Tolerances Service including thresholds and breach handling
• Acts as the primary Control Objective Owner in the UCL Owns Policy Creation and Approval Service defining principles and rules
• Own and oversees the Policy Exception Management Framework
• Defines and maintains the UCL
• Performs Horizon Scanning service - proactively identifying emerging risks regulatory expectations and analysing their impact on the risk and control framework
• Monitors compensating controls tracks exception lifecycle and escalates overdue or high-risk exceptions
• Manages the Technology amp Cyber Risk Committee Secretariat amp Governance Service agenda minutes actions
• Provides Methodology amp Tooling Enablement Service - training guidance and templates for 1LOD risk assessments
• Facilitates Control Objective Clinics Service to ensure 1LOD 1 5LOD understanding of control requirements
• Manages the quality assurance process for 2LOD activities

Personnel Specifications:

• 15+ years in cyber/technology risk governance, policy development, or security management within financial services
• Experience in non-financial risk management and control framework development and regulatory compliance
• Track record of engaging with regulators
• Experience establishing governance structures and committees
• Bachelor's degree in Information Technology, Computer Science, or related field
• CISA certification required or in progress
• CISSP or CISM advantageous
• Knowledge of ISO 27001, NIST CSF