Technology Risk & Control Consultant

TECSTATION PTE. LTD.; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

LinkPay is seeking a Technology Risk & Control Consultant to strengthen its technology risk and digital operations resilience architecture in Singapore. This role offers a pivotal opportunity to shape the organisation's tech risk strategy and resilience operations.

You will lead regulatory alignment, gap assessments, and control framework development across MAS TRM, DORA, and related standards, partnering with IT, compliance, and risk teams.

Responsibilities

• Regulatory Compliance & Gap Assessment: lead and implement digital operations resilience and technology risk strategies to identify, assess, mitigate risks, and drive strategic projects to enhance capabilities.
• Policy, Framework & Documentation: draft and maintain ICT risk management frameworks and DR/BCP documentation aligned to MAS TRM and DORA.
• Third-Party & ICT Risk Management: manage third-party risk lifecycle including due diligence, contractual review, monitoring and exit planning.
• Incident Management, Testing & Resilience: support incident classification, escalation, reporting, and resilience testing including TLPT with security teams.
• Governance, Training & Stakeholder Engagement: liaise with regulators and auditors; deliver training on MAS TRM and DORA obligations; prepare management reporting.

Job description

Technology Risk & Control Consultant

Role Overview

Join a role that's centralto our Technology security and resilience architecture, offering a uniqueopportunity to shape our organisation's tech risk and digital operationsresilience strategy and operations.

As a Tech Risk & ControlConsultant at LinkPay, you will play apivotal role in shaping and implementing the organization's Technology Risk and Digital Operations Resilience strategy and operations.

Key Responsibilities

1. Regulatory Compliance & Gap Assessment
   • Independently lead and implementdigital operations resilience and technology risk management strategies,policies, and processes to identify, assess, mitigate risks, and drivestrategic projects and initiatives to enhance the organization'stechnology risk management and digital operations resilience capabilities, in line withMAS TRM, EU DORA, industry best practices and the organization's standards andregulatory requirements.
   • Conduct periodic gap assessmentsmapping current technology, cybersecurity, and third-party risk controlsagainst MAS TRM and DORA's five pillars (ICT risk management, incidentreporting, digital operational resilience testing, third-party risk management,information sharing) domains.
   • Track regulatory developments,technical standards updates, and supervisory expectations issued by the ESAs(EBA, ESMA, EIOPA), MAS TRM & Outsourcing domains, and translate these intointernal policy and control updates.
2. Policy, Framework & Documentation
   • Draft, review, and maintain ICTrisk management frameworks, technology risk policies, business continuity anddisaster recovery (BCP/DR) documentation, and third-party/outsourcing riskpolicies aligned to MAS TRM, DORA and industry best practices.
   • Develop and maintain the ICTRegister of Information (RoI) required under MAS TRM and DORA, and equivalentthird-party/vendor risk registers, in line with industry best practices andoutsourcing guidelines.
   • Prepare quarterly board andmonthly management-level reporting MIs, risk registers, and compliancedashboards summarising technology risk posture, control effectiveness, andregulatory readiness.
3. Third-Party & ICT Risk Management
   • Own the third-party/ICT serviceprovider risk management lifecycle: due diligence, contractual clause review(including DORA-mandated contractual provisions), ongoing monitoring,concentration risk assessment, and exit strategy planning.
   • Assess and classifycritical/important ICT third-party providers in line with MAS TRM and DORAoutsourcing/criticality criteria.
   • Coordinate with procurement,legal, and vendor management teams to ensure new and existing technologycontracts meet regulatory requirements.
4. Incident Management, Testing & Resilience
   • Support the design andmaintenance of ICT-related incident classification, escalation, and regulatoryreporting processes consistent with MAS TRM, Outsourcing and DORA incidentreporting timelines and notification requirements.
   • Coordinate digital operationalresilience testing, including vulnerability assessments, scenario-basedtesting, and (where applicable) threat-led penetration testing (TLPT), workingwith Information Security and external testing providers.
   • Support tabletop exercises,BCP/DR testing, and crisis simulation exercises to validate organisationalresilience against ICT disruption.
5. Governance, Training & Stakeholder Engagement
   • Act as co-liaison withregulators, auditors, and examiners on technology risk and digital operationalresilience matters, including preparation of regulatory submissions andresponses to inspection findings.
   • Design and deliver training andawareness programmes on MAS TRM, Outsourcing and DORA obligations fortechnology, risk, compliance, and business stakeholders.
   • Support committee reporting(Risk & Compliance Committee, ICT Risk Committee) with clear,decision-ready materials on technology risk exposure and remediation status.
   • Partner with Technology, Complianceand Legal teams to embed regulatory requirements into day-to-day operationalpractice.