Head of IS Risk Management

About the Role
The purpose of this role is to manage and oversee the full spectrum of information security risk management, ensuring that the risk management framework is reviewed and adapted to meet the Group’s needs and requirements. This position involves identifying, assessing, and treating risks to the confidentiality, integrity, and availability of assets.

Key Accountabilities

• Manage and supervise cybersecurity risk assessments for business services, processes, and technologies.
• Stay informed about global and regional information security threats by reviewing threat intelligence reports from the Group Information Security Department’s (GISD) Cyber Threat Intelligence unit and use findings to identify risks.
• Review security/vulnerability assessments and penetration testing reports from GISD’s Attack Surface Reduction unit and use findings to identify risks.
• Identify and prioritize risk scenarios, reporting to management.
• Ensure the proper delivery of ad-hoc and planned risk assessments in accordance with internal and external information security policies, regulations, and standards.
• Oversee and manage risk monitoring plans, collaborating with relevant business units to ensure effective implementation of mitigation controls.
• Manage the implementation of systems and tools to automate the end-to-end information security risk management cycle.
• Work alongside the Head of IS Governance and Risk Management to continuously improve policies, procedures, standards, and guidelines based on risk assessment findings and recommendations.
• Present management reports highlighting the Group’s risk status and posture.
• Supervise information security-related projects, such as security integration into coding and testing, to assess associated information security risks.
• Finalize and confirm reports on risk management KPIs.
• Identify initiatives with the Head of IS Governance and Risk Management to continuously improve risk performance and develop remediation steps that help reduce risk to acceptable levels, comply with applicable laws and regulations, increase operational efficiency, and meet IS goals and objectives.
• Participate in communicating risk status to relevant internal/external stakeholders and follow up on risk remediation plans.
• Improve/develop QA routines and controls to ensure a focus on risk reduction within defined timelines.
• Measure, monitor, and report on information security risks.
• Review vendor/third party risk to support vendor risk management activities.
• Engage staff and/or vendors to create information security risk mitigation plans addressing risks identified in vendor risk reviews.
• Monitor and report on the execution of information security risk mitigation plans.
• Engage employees in managing information security risk and ensure awareness of their accountabilities.
• Regularly assess and report to management any exceptions to information risk management policies, procedures, and limits.
• Align with the VA/PT team to validate IS Risks.
• Collaborate with ORM, ITD, BCM, VCMP, and other relevant stakeholders.
• Develop strategic, tactical, and operational risk dashboard reports.
• Develop a Threat Modelling Process that utilizes quantitative and qualitative risk management measures.

Specialist Skills / Technical Knowledge Required

• Strong knowledge of banking and financial institutions' processes, information security technologies, practices, and systems.
• Bachelor’s degree (master’s degree preferred) in technology or related field or equivalent relevant work experience.
• Experience in the banking and financial services sector is preferred.
• Demonstrated business and supervisory acumen.
• Familiarity with GRC tools and other risk management platforms.
• Knowledge of ISO 27001, NESA, SWIFT CSP, PCI DSS, and other information security standards and regulations.
• Certifications such as Certified Information Systems Security Professional (CISSP) or Certified in Risk and Information Systems Control (CRISC) are strongly preferred.