Job purpose

The job holder acts as a second of defence (“2LoD”) and is responsible for providing oversight and challenges of technology risk management, cybersecurity risk management, and control effectiveness of first line of defence (“1LoD”). The job holder is also required to respond spontaneously to evolving business, environment, threats, and regulatory requirements.

Key Responsibilities

1. Assist to design, maintain and implement the technology risk management framework and ensure key industry standards such as ISO27001, NIST 800, and PCI-DSS are incorporated into the framework.
2. Responsible for operational risk identification, response, monitoring, reporting and execution of operational risk framework by reviewing the adequacy of the implemented controls.
3. Ensure 1LoD implementing appropriate controls to address identified technology risk, and provide oversights and challenges of 1LoD’s risk assessment and risk-taking activities.
4. Provide risk stewardship with appropriate risk management advice to technology and business stakeholders.
5. Support technology risk management activities including internal and external audits, new products proposals, project reviews, and regulatory returns and examinations such as C-RAF maturity assessment, iCAST exercise, TM-E-1 and TMG-1 ICA.
6. Assist team head to implement the control assurance strategy, methodology, related policies, guidelines and tools in line with regulatory requirements and industrial best practices.
7. Conduct assurance reviews on banking operations and IT risks and controls, including understanding relevant control designs, review scoping, control testing, and communication of findings with reviewee teams.
8. Perform deep-dive reviews or investigation into OR incidents to identify the root cause(s), provide recommendations to address the control weakness and evaluate the effectiveness of the corrective and preventive actions applied.
9. Assist team head in defining and reviewing Risk Appetite and Key Risk Indicators to measure and monitor technology and cybersecurity risk exposure.
10. Ensure timely and accurate submission of regular MIS on control assurance related issues to senior management of the Bank.
11. Participate in Committees and Meeting as member when required to provide oversights and challenges.
12. Prepare the bank-wide awareness or education program to promote the technology and cybersecurity risk cultures in the Bank.

Requirements

1. Degree holder preferably in Information Technology, Information Systems, Risk Management, Computer Science, or other relevant discipline.
2. 5 - 8 years of working experience in operational risk management, technology risk management, or information and cybersecurity risk management.
3. Prior experience in performing assurance reviews and IT audits is preferrable.
4. Knowledge of relevant regulatory requirements relating to Operational Risk Management in banking industry.
5. Certified in CISSP, CISA, CISM, CRISC or other recognized certificate is a must.
6. Self-motivated, independent and able to communicate effectively at all levels.
7. Good command of written and spoken English and Chinese (including Putonghua).

For more details about career opportunities with the Bank, please visit our website http://www.cncbinternational.com/careers/en/index.jsp. Please apply with full resume stating current and expected salaries.

Personal data collected will be used for recruitment related purposes only. Applicants not invited for interview within 6 weeks may consider their applications unsuccessful. However, applicants may be considered for other suitable positions within the Group for a period of not more than 2 years. Personal data will be destroyed at any time after 3 months.

China CITIC Bank International is committed to being an equal opportunities employer and intends to provide a work environment free of unlawful discrimination or harassment. All employment decisions will be made in a non-discriminatory manner.