Job Purpose:
Lead and govern the Group's technology risk framework, policy lifecycle, risk appetite, governance structures and regional oversight model to support effective second line oversight and regulatory compliance.
Define and maintain Group-wide technology risk governance standards and methodologies, including KRIs, KCIs and GTRM RCSA, and oversee consistent adoption across countries and relevant stakeholders.
Lead cross-country and cross-functional thematic risk assessments, consolidate Group and country technology risk insights, and provide independent challenge and escalation on material exposures, systemic control weaknesses and governance gaps.
Act as the senior Group point of contact for country technology risk governance, working with Technology Risk SME pillars and country teams while maintaining an independent Second Line perspective.
Key Responsibilities
Technology Risk Framework and Policy Governance
Maintain the Group Technology Risk Management Framework and Technology Risk Management Policy, including their review, update and approval lifecycle.
Ensure the framework and policy remain aligned with enterprise risk management, applicable regulatory requirements and recognised industry standards.
Define and maintain the documented Second Line of Defence mandate for technology risk and periodically assess framework effectiveness.
Set governance requirements for the lifecycle, inventory, review schedule, approval and version control of technology risk policies and procedures.
Provide independent second line challenge on material technology risk policies and procedures and oversee regulatory traceability and governance mappings.
Technology Risk Appetite, KRI, KCI and RCSA Governance
Develop and maintain the Group Technology Risk Appetite Statement for technology risk, including supporting tolerances, measurable monitoring requirements and escalation triggers.
Set requirements for technology risk ownership and residual risk acceptance, and review risk exposure against appetite using KRI, KCI, RCSA, thematic review and country risk information.
Define methodology and governance standards for technology risk KRIs, KCIs and GTRM RCSA, including indicator definitions, thresholds, taxonomies, rating scales, refresh cycles and escalation requirements.
Require enhancements where indicators, assessments or escalation arrangements do not provide meaningful risk information.
Group and Country Technology Risk Governance
Define and maintain the governance structures used to oversee technology risk across the Group, including committees, terms of reference, reporting requirements, escalation routes and decision rights.
Act as the Group point of contact for country technology risk governance and maintain minimum governance standards across Group and country technology risk functions.
Review and challenge country alignment with Group frameworks, governance requirements, risk appetite and applicable technology risk regulatory requirements.
Challenge country governance arrangements, independence, capability, risk positions and material control weaknesses, and escalate insufficient or repeated responses.
Thematic Risk Assessments and Consolidated Risk Insight
Lead and coordinate thematic risk assessments across countries, functions and key technology risk domains.
Work with Technology Risk SME pillars and country teams to define assessment scope, criteria, evidence requirements, participants and timelines.
Identify emerging risks, systemic control weaknesses, inconsistent control implementation and cross-border or cross-functional risk themes.
Consolidate country risk issues and thematic assessment outcomes into a Group view, highlighting matters that may require changes to the framework, appetite, policy, governance standards or control expectations.
Reporting, Committee Support and Follow-up
Prepare management and Board papers on technology risk framework, appetite, governance, country oversight and thematic assessment matters.
Support the Head of Governance & Enablement with regulatory responses and committee discussions, ensuring outputs are complete, consistent and fit for senior review.
Ensure material actions are assigned to accountable owners, monitor progress and escalate delays, weak responses or repeated issues.
Coordinate with relevant stakeholders where findings require policy updates, formal remediation tracking, revised indicators or enhanced risk reporting.
Job Specification:
Provides senior second line governance and oversight for the Group's Technology Risk Management Framework, policies, risk appetite, supporting methodologies and regional governance model.
Establishes Group-wide governance standards and provides independent challenge across countries and stakeholders to support consistent implementation, regulatory alignment and timely escalation of material technology risk exposures.
Leads thematic assessments and consolidates framework, appetite, indicator, RCSA and country-level information into clear Group-wide risk insight for management and Board oversight.
Bachelor's degree in information technology, Engineering, Risk Management, or a related discipline.
Certified Information Systems Security Professional (CISSP) or, Certified Information Security Manager (CISM) or Certified in Risk and Information Systems Control (CRISC).
10–15 years' experience in technology risk, cybersecurity, operational resilience, or technology risk oversight, preferably within banking or financial services.
Prior experience as a country‑level or regional Technology Risk Lead, or equivalent is preferred.
Experience working across multiple countries and regulatory environments.
Proven ability to engage senior stakeholders and constructively challenge country positions.
