Description
We are seeking a Cyber Risk Manager to provide independent second-line oversight, advice, and constructive challenge over the Group's management of cyber, AI, and data risks.
The successful candidate will lead cyber, data, and AI risk assessments, second-line external red team testing and cyber drills/tabletop exercises, provide emerging-risk analysis, and report material risks to senior management and governance committees.
Key responsibilities include:
- Identifying, assessing, and monitoring material cyber, data, and AI risks; providing independent advice and constructive challenge to ITD and other first-line owners, and escalating significant exposures with recommendations for mitigation and remediation.
- Monitoring, developing, and reporting key cyber risk and performance indicators, escalating trends, and providing risk insights where appropriate.
- Coordinating and overseeing risk-based external threat-led red-team and adversarial security testing; challenging scope, scenarios, coverage, independence, findings, and residual risk.
- Assessing and challenging ITD's defence-in-depth approach across identity, network, endpoint, application, data, cloud, third-party, and recovery controls.
- Developing and coordinating cyber tabletop and crisis-simulation activities that test decision-making, escalation, regulatory notification, communications, recovery, and dependencies.
- Providing independent insight supporting responsible AI governance, assessing cybersecurity, data, model, third-party, human-oversight, and resilience risks, and monitoring emerging AI-enabled threats.
- Supporting the Group's data governance and data risk management journey by advising on data confidentiality, integrity, availability, classification, access, lineage, quality, retention, sharing, and resilience.
Requirements:
- A self-motivated, reliable, collaborative, and proactive individual with strong influencing skills and excellent written and verbal communication abilities.
- At least 7 years (AVP) or 10 years (VP) of relevant experience in cyber security and related fields, preferably within the financial services sector or in professional services supporting financial services clients.
- Strong organisational and programme leadership skills, with the ability to prioritise, manage multiple significant assignments, and deliver high-quality outcomes with limited supervision.
- Strong stakeholder management skills and the confidence and credibility to provide constructive challenge, manage differing perspectives, and achieve appropriate risk outcomes.
- Strong practical knowledge of cyber risk governance, security architecture, defence-in-depth, red-team testing, penetration testing, cyber resilience, and crisis exercises.
- Professional certifications such as CISA, CISSP, CRISC, CISM, or other relevant technology risk, cybersecurity, or audit qualifications are preferred.