Manager, GR NFRM TRM - Cybersecurity Risk Management

Key Responsibilities:

• Support the implementation of compliance with the Operational Risk Management Framework (ORMF), Technology Risk Framework (TRMF), Cyber Resilience Framework (CRF), Cloud Risk Management Framework (CRMF), Emerging Technology Risk Framework (ETRF), AI/ML Risk Framework and P&P, Technology Risk Appetite Statement (TRAS) and BNM Risk Management in Technologies (RMiT) to effectively manage technology related risks, enhance technology resiliency and mitigate risks against technology threats across CIMB Group.

• Independently review and challenge control issues raised by the First Line of Defense (1LoD) to ensure accurate issue identification, root cause analysis, impact assessment, and issue rating.

• Assess the adequacy, completeness, and feasibility of remediation plans and closure evidence.

• Review issue resolution timelines and challenge unreasonable or unsupported target dates.

• Monitor aged, overdue, and high-risk control issues and escalate material concerns to relevant governance committees.

• Independently assess Control Issue Acceptance requests submitted by business units.

• Verify that all feasible remediation alternatives have been adequately evaluated before risk acceptance is considered.

• Work closely with Business Unit Control Officer (RCO) &/or DCORO to address key technology risks, controls and events, as part of existing Business Unit RCSA.

• Facilitate in preparing the Technology Risk Dashboard with objective to have one view of Risk Posture

• Major incident management review (Review LED) & BDSF

• Management and monitoring of Technology Key Risk Indicator and Technology Risk Appetite Statement (RAS)

• Risk hotspot – to highlight immediate key risks area to watch (Immediate, High, Medium and Low) pertaining to Technology, Cyber, IT in 3rd Parties, AI and Cloud.

• IT 3rd Parties Risk Management support

Job Specification

• Roll-out and enforce and TRMF, P&P and RMiT

• Validate effectiveness of security controls

• Provide assurance on technology risk

• Conduct independent risk assessment

• Review and challenge 1LOD risk assessment