Vice President Operational Risk Officer (ICT & Cyber)

Position Purpose: Implementation, management and oversight of 2nd line of defense (2LOD) risk management framework within the Information and Communication Technology (ICT) supporting APAC region (14 territories).Job ResponsibilitiesGovernance & Oversight: Provide IT & Cyber risk management oversight and advisory to business, technical, and operations groups; provide direction for managing security and technology risks of core systems; drive implementation of Operational Risk Management policies.Risk Management Environment: Identification & Assessment: Correlate Audit Findings, Internal/External Loss Data, RCSA, Business Process Mapping, KPIs/KRIs, and Scenario Analysis.Monitoring & Reporting: Regularly monitor operational risk profiles and material exposure; provide reporting to the board and senior management.Control & Mitigation: Review the control environment, assess risk response strategies, and validate risk transfer options.Risk Disclosure: Update regulatory and financial disclosures in compliance with board-approved policies.Contributing Responsibilities: Contribute to the establishment of an IT & Cyber Risk Management program in alignment with the Group Risk Management Framework.Assist in establishing risk management governance committees.Oversee Business Resiliency & Continuity plans to ensure ongoing operations during disruptions.Required Qualifications, Capabilities, and SkillsGraduate or post-graduate qualification in ICT , risk management, or control functions.15years or more of experience or practical understanding in IT, IT Security, or other ICT domains.Technical Knowledge:Strong understanding of Information Security Risks (Technology Risk, Business Continuity Risk, etc.).Functional knowledge in Security Architecture, Malware Protection, Identity & Access Management, Secure Configuration, Security Testing, and Emerging Technology Security.Understanding of network devices, servers, Firewall, IDS, IPS, SIEM, DLP, Proxy, Web/Email Content Filtering, and Anti-Virus.Understanding of vulnerability assessments, penetration testing, and incident response for cyber incidents.Understanding of ISO 2700X series standards and guidelines.Skills:Behavioural: Decision Making, Client focused, Ability to collaborate/Teamwork, Attention to detail/rigor.Transversal: Analytical Ability, Project management, Ability to develop others.Technical: Business process re-engineering, functional and enterprise technical architecture, and IT Service Management/Service Continuity domains.Conduct: Proactivity, transparency, and accountability regarding conduct risks.Preferred Qualifications, Capabilities, and SkillsProfessional Certifications: CISA, CISM, or CRISC.Regulatory Expertise: Experience with EU regulations (DORA, CRA, GDPR) and US cybersecurity frameworks (NIST).Specialized Experience:Experience in managing Enterprise Risk and infrastructure security.Strong experience in Third Party Risk assessment processes.Experience with risk management tools and information systems.Experience with emerging technologies such as IoT and Cloud.Significant experience in Operational Resilience and Crisis Management.