VP/SVP, Risk & Controls Officer (Architecture & Engineering), Technology Group

GIC; Singapore; Hybrid; SGD 240,000 - 320,000; Full time

Job summary

GIC is seeking a VP/SVP Risk & Controls Officer (Architecture & Engineering) to embed risk and security into technology strategy, architecture, and transformation programmes. You will partner with strategy, enterprise architecture, and platform teams to ensure secure, resilient operations supporting investment decision-making.

You will lead controls design across SDLC, DevOps pipelines, and data governance, while advancing risk monitoring through KCIs, KRIs, and ORSA.

Qualifications

• Minimum 12 years for senior appointments in technology risk, IT controls, or IT audit within financial services.
• Experience partnering with strategy, enterprise architecture, or large-scale transformation programmes.
• Hands-on experience with DevOps, CI/CD, and secure SDLC practices.

Responsibilities

• Embed risk and control considerations into technology strategy and architecture roadmaps.
• Coordinate with engineering to manage risks across developer tooling and AI foundation platforms.
• Design and embed controls across the technology lifecycle (SDLC, access controls, data governance).
• Maintain ORSA and CCM progress toward continuous controls monitoring.
• Support RCA, CAPA, and timely closure of control gaps.

Skills

Tech risk

IT controls

Operational risk

IT audit

DevOps

CI/CD

Stakeholder mgmt

TOGAF

COSO/COBIT

AI/ML risk

Education

Degree in IS/CS/Finance

Tools

CISA

CRISC

CISSP

Job description

GIC is one of the world’s largest sovereign wealth funds. With over 2,000 employees across 11 locations around the world, we invest in more than 40 countries globally across asset classes and businesses. Working at GIC gives you exposure to an extraordinary network of the world’s industry leaders. As a leading global long-term investor, we Work at the Point of Impact for Singapore’s financial future, and the communities we invest in worldwide.

Technology Group

We experiment, design, and lead a 24×7 global business where we support core capabilities in asset management, trading, investment operations, and risk management. We deliver secure, reliable, and integrated solutions, and provide insights on new, and emerging technologies.

Infrastructure & Cybersecurity Resilience (ICR)

We design, build, and secure the technology foundations that power GIC’s global investment operations. We aim to deliver resilient, scalable, and secure infrastructure that empowers our people and businesses to perform securely, efficiently, and effectively.

What impact can you make in this role?

We are seeking a Risk & Controls (R&C) professional to be embedded within the Technology function supporting investment and corporate business units. This role will be part of the R&C function which comprises team members driving R&C Strategy and Standards settings.

Operating within the First Line of Defence, this role partners with engineering, architecture, and platform teams to ensure technology risks are effectively managed and controls are embedded across systems and delivery processes. The role focuses on enabling secure, resilient, and well-governed platforms that support investment decision-making and operations.

What will you do as a VP/SVP Risk & Controls Officer (Architecture & Engineering)?

Architecture, Strategy & Transformation

• Partner with strategy and architecture leadership to embed risk and control considerations into technology strategy, enterprise architecture, and transformation roadmaps
• Provide risk input into architecture decision-making, technology standards, and the design of major transformation and change programmes
• Ensure control requirements and 'secure and controlled by design' principles are embedded into architecture standards, reference patterns, and transformation gating, evidenced through architecture governance forums (e.g., design authorities, change gates) and Key Control Indicators (KCIs)
• Translate strategic and architectural risks into clear business impact and mitigation actions for senior technology and business stakeholders

Developer Tooling & AI Foundations

• Partner with engineering teams to identify, assess, and manage risks across developer tooling and AI foundation platforms, coordinating with broader infrastructure risk assessments
• Embed preventative controls and early issue detection (e.g., vulnerability scanning, SAST/DAST) into developer tooling and CI/CD pipelines

Controls Design, Implementation & Monitoring

• Design and embed controls across the technology lifecycle (SDLC, change management, access controls, data governance) within the domain
• Ensure controls are integrated into delivery workflows (e.g., DevOps, CI/CD) and validate adherence to governance processes, evidenced by Key Control Indicators (KCIs)
• Maintain and enhance Operational Risk Self-Assessments (ORSA), progressing toward evidence-based, continuous controls monitoring (CCM)

Operational Resilience & Incident Management

• Support system resilience, disaster recovery, and service continuity frameworks
• Contribute to incident and problem management: drive Root Cause Analysis (RCA) and manage Corrective and Preventive Actions (CAPA) to ensure control gaps are permanently fixed
• Ensure timely closure of control gaps and sustainable remediation

Monitoring & Reporting

• Develop and track Key Risk Indicators (KRIs) and Key Control Indicators (KCIs) for the domain
• Produce risk dashboards and insights for senior stakeholders
• Highlight emerging risks across systems, platforms, and dependencies

Compliance with Standards & Procedures

• Adhere to, and provide feedback on, the standards and Standard Operating Procedures (SOPs) defined for the first line of defence
• Support internal compliance checks against defined standards relevant to the domain

Audit & Third-Party Governance

• Support internal and external audit engagements: collate and review control artefacts, and provide domain input to management responses
• Support risk assessments and controls for vendors and service providers, ensuring appropriate oversight of outsourced technology services

Stakeholder Engagement

• Act as a liaison between technology teams (first line), IT risk management (second line), and internal audit (third line)
• Build strong relationships with engineering and platform teams
• Promote a risk-aware culture while supporting delivery and innovation

What qualifications or skills should you possess in this role?

• Minimally 12 years for senior appointments, or minimally 7 years for mid-level appointments, in technology risk, IT controls, operational risk, or IT audit within financial services; senior appointments also include team or workstream leadership
• Experience partnering with strategy, enterprise architecture, or large-scale transformation and change programmes
• Hands-on experience with DevOps, CI/CD, and developer tooling or secure SDLC practices
• Familiarity with programme or portfolio risk management, or AI/ML and emerging-technology risk, is a strong plus
• Strong understanding of technology risk domains (access management, SDLC, cloud, data governance), with emphasis on vulnerability management, pipeline controls, and preventative shift-left control design
• Understanding of enterprise architecture frameworks (e.g., TOGAF), technology strategy, transformation delivery risk, and AI/ML risk considerations
• Knowledge of control frameworks (e.g., COSO, COBIT) and operational risk methodologies (ORSA)
• Ability to balance risk management with delivery priorities; strong stakeholder management and communication skills
• Degree in Information Systems, Computer Science, Finance, or a related field; relevant certifications (e.g., CISA, CRISC, CISSP) are advantageous

Work at the Point of Impact

We need to be forward-looking to attract the right people to help us become the Leading Global Long-term Investor. Join our ambitious, agile, and diverse teams - be empowered to push boundaries and pursue innovative ideas, share your views, and be heard. Be anchored on our PRIME Values: Prudence, Respect, Integrity, Merit and Excellence, which guides us in how we make our day-to-day decisions. We strive to inspire. To make an impact.

GIC is a Great Place to Work

At GIC, our offices are vibrant hubs for ideation, professional growth, and interpersonal connection. At the same time, we believe that flexibility allows us to do our best work and be our best selves. Thus, our teams come into the office four days per week to harness the benefits of in-person collaboration, but have the flexibility to choose which days they work from home and adjust this arrangement as situational needs arise.

GIC is an equal opportunity employer

As an employer, we passionately believe every individual brings with them unique diversity of thought and perspectives to meaningfully enrich perspectives of GIC teams to drive competitive performance. An inclusive environment yields exceptional contribution.

Learn more about our Technology Group here: https://gic.careers/group/technology-group/

Our PRIME Values

GIC is a values driven organization. GIC’s PRIME Values act as our compass, enabling us to fulfil our fundamental purpose and objectives. It is the foundational bedrock which governs our behaviors, our decision making, and our focus. It informs both our long-term strategy as a firm, and the way we relate to our Client, business partners and employees. PRIME stands for Prudence, Respect, Integrity, Merit and Excellence.