Head of IS Risk Management

About the Role
The purpose of this role is to manage and oversee the full spectrum of information security risk management, ensuring the completion of the risk management framework to meet the Group’s needs and requirements. This position involves identifying, assessing, and treating risks to the confidentiality, integrity, and availability of assets.

Key Accountabilities of the Role

• Manage and supervise cybersecurity risk assessments for business services, processes, and technologies.
• Stay informed about global and regional information security threats by reviewing threat intelligence reports from the Group Information Security Department’s Cyber Threat Intelligence unit, identifying risks based on findings.
• Review security/vulnerability assessments and penetration testing reports from the Attack Surface Reduction unit to identify risks.
• Identify and prioritize risk scenarios, reporting to management.
• Ensure proper delivery of ad-hoc and planned risk assessments in alignment with internal information security policies and external regulations.
• Oversee and manage risk monitoring plans, collaborating with relevant business units for effective implementation of mitigation controls.
• Manage the implementation of systems and tools to automate the end-to-end information security risk management cycle.
• Work collaboratively with the Head of IS Governance and Risk Management for continuous improvement in policies, procedures, standards, and guidelines based on risk assessment findings.
• Present management reports highlighting the Group’s risk status and posture.
• Supervise information security-related projects, such as security integration into coding and testing.
• Finalize and confirm reports on risk management KPIs.
• Identify initiatives in collaboration with the Head of IS Governance and Risk Management to improve risk performance and develop remediation steps that help Group entities comply with laws, increase operational efficiency, and meet IS goals.
• Communicate risk status and remediation plans to relevant stakeholders, following up on implementation.
• Improve and develop QA routines and controls to ensure timely risk reduction.
• Measure, monitor, and report on information security risks.
• Review and report on vendor/third-party risks to support vendor risk management activities.
• Engage staff and vendors to create information security risk mitigation plans based on Vendor risk reviews.
• Monitor and report on information security risk mitigation plans to ensure timely execution.
• Involve employees in managing information security risk and ensure their awareness of accountabilities.
• Regularly assess and report any exceptions to information risk management policies, procedures, and limits to management.
• Align with VA/PT team to validate IS Risks.
• Coordinate with ORM, ITD, BCM, VCMP, and other relevant stakeholders.
• Develop strategic, tactical, and operational risk dashboard reports.
• Develop a Threat Modelling Process using quantitative and qualitative risk management measures.

Specialist Skills / Technical Knowledge Required

• Strong knowledge of banking and financial institution processes, information security technologies, processes, and systems.
• Bachelor’s degree (master’s degree preferred) in technology or related field or equivalent years of relevant work experience.
• Preferred experience in the banking and financial services sector.
• Good business and supervisory acumen.
• Familiarity with GRC tools and other risk management platforms.
• Knowledge of ISO 27001, NESA, SWIFT CSP, PCI DSS, and other information security standards and regulations.
• Strongly preferred certifications: Certified Information Systems Security Professional (CISSP) or Certified in Risk and Information Systems Control (CRISC).