Section Head, Technology Risk Management, Information Security Department

About the role

The Section Head, Technology Risk Management reports to the Chief Information Security Officer within the Group Risk / Information Security division. This role is responsible for reviewing and improving the ISD Framework, Policy, and Procedure; managing communications with external stakeholders including BNM, PayNet, SWIFT, and External Audit, as well as internal stakeholders such as the Compliance Department, ITSD, Digital Banking, and Business Units; and providing advisory on technology risks to the Board, Management, Business Units, and Subsidiaries.

Key responsibilities

• Review and improve ISD Framework, Policy, and Procedure

• Manage communication with external stakeholders (BNM, PayNet, SWIFT, External Audit)

• Manage communication with internal stakeholders (Compliance Liaison Officer, Compliance Dept., ITSD, Digital Banking, Business Units, Subsidiary)

• Review and manage ISD Reports (yearly, quarterly, monthly, ad hoc)

• Review and manage departmental finance including budget and spending

• Provide advisory on Technology Risks

• Perform and manage Technology Risk Assessment

• Conduct and manage IT Risk Awareness

• Represent department in meetings as necessary

• Manage departmental goals from planning to completion

About you

• At least 12 years of relevant experience in Information Security / IT Risk management position, preferably in development banking or relevant banking / financial environment

• Graduate degree in Information Technology, Computer Science, or other relevant major

• Professional certificate in Information Security / IT Risk / IT Security (preferred)

• Exposure to IT technical and governance tasks such as security administrator, system, and network administrator

• Knowledge of Technology Risk Assessment, follow-ups, and reporting

• Ability to prepare awareness materials and coordinate with Academy, Business Units, and Corporate Communication

• Experience developing and maintaining Framework, Policy, and Procedure documentation

• Presentation skills to communicate updates to relevant groups and committees

• Problem-solving skills to analyze information security issues and recommend solutions

• Technical knowledge of security controls including Cloud, Firewall, DLP, SIEM, System and Network Administration