Description
This role sits at the centre of how we manage Non-Financial Risk and controls across the Entity. You'll assess the adequacy of the risk and control environment then report clearly to senior stakeholders with actions tracked through to closure. The role spans core technology and cyber domains including vulnerability management, identity and access management, SDLC and DEPL and change and IT operations.
Responsibilities:
- Ensure resources and infrastructure are in place to sustain Risk and Control capability across the Entity
- Assess the adequacy of the risk and control environment then report findings through clear senior-level updates
- Review MSII proposals to confirm completeness, raise gaps and track actions through to closure
- Complete Read Across exercises in line with the global methodology
- Support RCA refresh processes and help control owners when RTCL updates are released
- Coordinate Critical Process Updates in line with the framework timeline
- Govern adherence to Group Standards and regulatory expectations and respond to Group Audit requirements
- Oversee dispensation requests from countries related to the management of the risk environment
- Identify risk and control trends to anticipate future developments and shape practical improvements
- Influence the development and implementation of future-fit risk management and regulatory frameworks
Requirements:
- Bring substantial experience across cyber and technology risk and controls including vulnerability management and identity and access management
- Apply hands-on knowledge of SDLC and DEPL and change management and IT operations in control design and remediation
- Coordinate control monitoring, control testing, control remediation, control assessment and control reporting across infrastructure teams
- Partner with service owners, product owners, engineers, infrastructure teams and third parties to align priorities and remove blockers
- Translate technical remediation into business impact, risk reduction and customer outcomes for senior stakeholders
- Produce clear written reporting for senior stakeholders including risk assessments and control evidence
- Demonstrate a strong risk mindset across security, resilience and operational risk requirements
- Build effective stakeholder relationships across CCO Tech and Cybersecurity and Data Architecture and work closely with technical SMEs