IT Business Risk Manager

Metrobank; Metro Manila; On-site; PHP 1,200,000 - 2,400,000; Full time

Job summary

Metrobank is seeking an IT Business Risk Manager to lead and strengthen the IT risk management program across the group’s technology environment. You will drive the risk framework, coordinate across business and IT stakeholders, and ensure compliance with policies, regulatory requirements, and governance standards.

With a minimum of 10 years in IT risk, you will mentor teams, define KRAs/KPIs, and elevate risk awareness to support strategic objectives and secure the institution’s resilience and

Qualifications

• Bachelor's Degree holder; an MBA or other relevant postgraduate qualification is an advantage.
• Minimum of 10 years of progressive experience in IT Risk Management, with increasing levels of responsibility.
• Strong understanding of IT operations, technology environments, and business processes.
• Proven experience in designing, implementing, and managing an IT Risk Management Framework.
• Demonstrated ability to assess IT risk management policies and processes, identify control gaps, and propose improvements.
• Experience leading the development, implementation, and achievement of KRAs and KPIs within an IT Risk Management function.
• In-depth knowledge of BSP Circular No. 1213 (2025) and related regulatory requirements.
• Preferably with IT Risk Management experience gained within a local banking institution.

Responsibilities

• Lead the execution and continuous enhancement of the IT Risk Management Framework, driving awareness of its value and promoting its use across the IT Group.
• Conduct comprehensive IT risk assessments and analyses to identify process weaknesses, control deficiencies, and underlying causes of risk exposures.
• Ensure that policies, procedures, and processes are appropriate, compliant, and consistently implemented.
• Assess the IT Group’s risk management capability requirements and facilitate relevant training and development initiatives.
• Develop risk treatment plans, define mitigation strategies, and set timelines with stakeholders.
• Monitor and ensure the effective execution of risk mitigation measures and action plans approved by senior management and the Board.
• Identify and evaluate existing, emerging, and cross-functional IT risks, communicating significant exposures to Senior Management.
• Review key IT risks and controls to ensure alignment with risk appetite and governance standards.
• Prepare and present risk management reports to management and Board-level committees.

Skills

Risk management

Stakeholder engagement

Regulatory understanding

Education

Bachelor's Degree

MBA or related postgraduate

Tools

IT risk tools

Job description

Here at Metrobank, we don't simply hire employees - we hone future leaders. We provide opportunities that enhance your skills and unlock your talents, helping you evolve into a well-rounded individual. We supply you with all the pieces you need to do your best work, unleashing your full potential to help you secure your future and lead a fulfilling career. And with Metrobank's strong heart for the community, you have the chance to give back and make worthwhile contributions to our nation's economic and social development. With Metrobank, a meaningful life is within your reach!

The IT Business Risk Manager is responsible for leading and supporting the Information Technology Group in the effective management of operational risk on a day-to-day basis. The role ensures that risks associated with IT products, services, processes, activities, and systems are proactively identified, assessed, monitored, mitigated, and reported. Working closely with business and technology stakeholders, the incumbent drives the implementation of the IT risk management framework, promotes a strong risk-aware culture, and ensures compliance with enterprise-wide risk management policies, regulatory requirements, and governance standards. The position also provides strategic guidance to management in addressing risk exposures and strengthening controls to support the organization's business objectives.

Key Responsibilities

• Lead the execution and continuous enhancement of the IT Risk Management Framework, driving awareness of its value and promoting the effective use of risk management tools across the IT Group.
• Conduct comprehensive IT risk assessments and in-depth analyses to identify process weaknesses, control deficiencies, and underlying causes of risk exposures.
• Ensure that business unit-specific policies, procedures, and processes are appropriate, compliant, and consistently implemented.
• Assess the IT Group’s risk management capability requirements and facilitate relevant training and development initiatives.
• Partner with stakeholders in developing risk treatment plans, defining mitigation strategies, assigning accountabilities, and establishing implementation timelines.
• Monitor and ensure the effective execution of risk mitigation measures and action plans approved by senior management and the Board.
• Identify and evaluate existing, emerging, and cross-functional IT risks, and communicate significant risk exposures to Senior Management.
• Periodically review key IT risks, internal controls, and operational risk mitigation programs to ensure risks are managed within approved risk appetite and in accordance with enterprise-wide risk management standards.
• Prepare and present regular risk management reports to management and Board-level committees, highlighting significant risk issues and areas requiring immediate attention.
• Escalate concerns and intervene when risk management activities are impeded, ensuring that risk-related issues are addressed appropriately and transparently.

Qualifications

• Bachelor's Degree holder; an MBA or other relevant postgraduate qualification is an advantage.
• Minimum of 10 years of progressive experience in IT Risk Management, with increasing levels of responsibility.
• Strong understanding of IT operations, technology environments, and business processes.
• Proven experience in designing, implementing, and managing an IT Risk Management Framework.
• Demonstrated ability to assess IT risk management policies and processes, identify control gaps, and recommend improvements.
• Experience leading the development, implementation, and achievement of KRAs and KPIs within an IT Risk Management function.
• In-depth knowledge of BSP Circular No. 1213 (2025) and related regulatory requirements.
• Preferably with IT Risk Management experience gained within a local banking institution.