Head of Cyber Risk Oversight

Tawteen; Muscat; On-site; OMR 120,000 - 180,000; Full time

Job summary

Tawteen in Muscat, Oman seeks a Head of Cyber Risk Oversight to support the Head of Technology and Cyber Risk in the Bank's second line of defence. You will oversee the independent data-led view of cyber risk and manage the assurance programme with executive committees and the Board.

The role leads the Risk Aggregation & MI Board ExCo service, maintains MI dashboards, and prepares risk posture reports for management. A strong background in regulatory reporting and banking cyber risk is essential.

Qualifications

• 15+ years in cyber/technology risk, IT audit, or security assurance within banking or financial services.
• Minimum 6 years leading teams in a risk oversight or assurance function.
• Demonstrable experience in regulatory reporting and engagement.
• Track record of presenting risk insights to senior management.
• Experience coordinating with internal audit and external regulators.

Responsibilities

• Ensures the delivery of an independent data-led view of the cyber risk posture to executive committees and the Board leading the assurance programme
• Leads the Risk Aggregation & MI Board ExCo service by preparing independent risk posture reports and commentary for management
• Maintains MI dashboards and supports the preparation of executive committee packs
• Defines and monitors Key Risk Indicators (KRIs)
• Collects analyses and validates risk data, KRIs incidents, losses, audit findings
• Defines and maintains the Tech Cyber Enterprise Risk Framework Service risk taxonomy and methodologies e.g. RCSA impact likelihood scales
• Ensures credible evidence-based challenge is applied to first line of defence (IT 1LOD) risk decisions and control effectiveness
• Manages the relationship with regulators on cyber risk topics leading the Regulatory & Supervisory Engagement service
• Provides Incident & Resilience Oversight service - acting as an independent observer during major incidents and resilience testing
• Challenges 1LOD Root-Cause Analysis (RCA)
• Facilitates the setting and maintenance of the Cyber Risk Appetite & Tolerances Service including thresholds and breach handling
• Ensures consistent application of the risk methodology across the 1LOD

Skills

Cyber risk leadership

Regulatory engagement

Executive reporting

Risk data analysis

Stakeholder management

Education

Bachelor's degree in IT/CS/Business

CISA/CISM/CRISC certification

Job description

Job Title Head of Cyber Risk Oversight Department Risk Management Main Role Overall accountability The Head of Cyber Risk Oversight supports the Head of Technology and Cyber Risk in the Bank's second line of defence in oversight of cyber risk by acting as the primary Cyber Control Overseer Challenger Principal Accountabilities Ensures the delivery of an independent data-led view of the cyber risk posture to executive committees and the Board leading the assurance programme Leads the Risk Aggregation & MI Board ExCo service by preparing independent risk posture reports and commentary for management Maintaining MI dashboards and supports the preparation of executive committee packs Defines and monitors Key Risk Indicators KRIs Collects analyses and validates risk data KRIs incidents losses audit findings Defines and maintains the Tech Cyber Enterprise Risk Framework Service risk taxonomy and methodologies e g RCSA impact likelihood scales Ensures credible evidence-based challenge is applied to first line of defence IT 1LOD risk decisions and control effectiveness Manages the relationship with regulators on cyber risk topics leading the Regulatory & Supervisory Engagement service Provides Incident & Resilience Oversight service - acting as an independent observer during major incidents and resilience testing Challenges 1LOD Root-Cause Analysis RCA Facilitates the setting and maintenance of the Cyber Risk Appetite & Tolerances Service including thresholds and breach handling Ensures consistent application of the risk methodology across the 1LOD

Principal Accountabilities

• Ensures the delivery of an independent data-led view of the cyber risk posture to executive committees and the Board leading the assurance programme
• Leads the Risk Aggregation & MI Board ExCo service by preparing independent risk posture reports and commentary for management
• Maintains MI dashboards and supports the preparation of executive committee packs
• Defines and monitors Key Risk Indicators (KRIs)
• Collects analyses and validates risk data, KRIs incidents, losses, audit findings
• Defines and maintains the Tech Cyber Enterprise Risk Framework Service risk taxonomy and methodologies e.g. RCSA impact likelihood scales
• Ensures credible evidence-based challenge is applied to first line of defence (IT 1LOD) risk decisions and control effectiveness
• Manages the relationship with regulators on cyber risk topics leading the Regulatory & Supervisory Engagement service
• Provides Incident & Resilience Oversight service - acting as an independent observer during major incidents and resilience testing
• Challenges 1LOD Root-Cause Analysis (RCA)
• Facilitates the setting and maintenance of the Cyber Risk Appetite & Tolerances Service including thresholds and breach handling
• Ensures consistent application of the risk methodology across the 1LOD

Personnel Specifications:

• 15+ years in cyber/technology risk, IT audit, or security assurance within banking or financial services
• Minimum 6 years leading teams in a risk oversight or assurance function
• Demonstrable experience in regulatory reporting and engagement
• Track record of presenting risk insights to senior management
• Experience coordinating with internal audit and external regulators
• Bachelor's degree in Information Technology, Computer Science, Business, or related field
• CISA, CISM, or CRISC certification required
• CIA or equivalent audit qualification advantageous
• Knowledge of banking regulations (CBO, Basel)