The purpose of this role is to represent 2nd line risk as a technology SME. We are seeking an individual with specialist insight and understanding spanning technology, information security, resilience, and cyber risk. They will help us oversee and monitor the execution of our risk frameworks, and ensure that IT and information security risks are appropriately managed.

What the role is
The purpose of this role is to represent 2nd line risk as a technology SME. We are seeking an individual with specialist insight and understanding spanning technology, information security, resilience, and cyber risk. They will help us oversee and monitor the execution of our risk frameworks, and ensure that IT and information security risks are appropriately managed.

Where it fits
The role forms part of the group operational risk team. As we scale and digitalise our business, we are looking to grow our 2nd line technology risk capability.

What you’ll be doing
You will be a trusted partner to IT risk managers and technology teams, providing relevant expertise and advice in order to:

• Independently challenge the technology risk and control environment
• Support the development and maturity of risk frameworks, policies, and processes
• Help identify risk exposure, both present and emerging
• Specific activities you’ll carry out

Risk frameworks
Facilitate maintenance and continuous enhancement to the technology risk framework, and oversee the implementation of and conformance to the framework.

Risk and control assessments
Provide subject matter expertise to risk and control assessments, guiding and challenging 1st line assessment processes and outcomes, and identifying common themes.

Risk exposure management
Perform independent monitoring of the technology environment, tracking key risk exposures and progress of remedial work, including monitoring of compliance with technology policies and standards.

Risk events
Review and challenge technology risk events, including appropriateness of ratings, capturing of key details such as root cause analysis and business impact, and monitoring of trends.

Reporting
Support review and consolidation of information, facilitating accurate / meaningful risk reporting and ensuring that technology and related risks are appropriately escalated within risk governance structures.

Information security and cyber
Assist in overseeing the effectiveness of the group’s security architecture and controls, identifying key themes that may impact the security posture, and staying abreast of new threats and vulnerabilities.

Scenario analysis
Facilitate capital modelling processes, providing input into scenario selection and design, participating in workshops with technology and business stakeholders, and reviewing outcomes.

Emerging risks
Scan emerging themes and horizon risks, helping establish a forward-looking view of emerging exposures, evaluating risk drivers, and supporting risk mitigation activities.

Other responsibilities
You will participate in a wide range of governance forums and committees, collaborate with other functions in support of combined assurance, and contribute to risk assessment of new technologies.

Skill and experience we’re looking for

• Technical knowledge
• Previous experience in a technology risk role (any line of defence) or interest in moving to such a role
• Minimum 7 years’ experience in a financial institution or other regulated environment
• Solid understanding of IT risk management practices, frameworks and industry standards
• Familiarity with modern technologies such as Cloud, APIs, and DevOps
• Professional certifications are an advantage (e.g. CISSP, CRISC, CISA, CISM)

Skills and how they are applied

• Resolute character and the ability to challenge and drive robust, constructive debate
• Able to work well with others and see diverse stakeholder perspectives
• Committed, self-motivated, and comfortable taking ownership of tasks
• Ability to articulate views and risk concepts clearly and in language appropriate to the audience
• Passionate about technology, combined with a genuine interest in risk management