Job Description

• Support the implementation of a comprehensive Third Party Risk Management Framework within the IT function
• Conduct third party risk assessment for IT managed third parties
• Assist AGM of Control Assurance & Governance team in managing the lifecycle of control assurance review including scoping, fieldwork, and control testing etc. 
• Perform control assurance activities in a set of domains including Business Continuity Planning/Disaster Recovery, Project Management, Third-party Risk Management, Change Management, Incident Management, IT Operations and Release Management
• Document the control assurance assessment report, publish and socialize to senior management
• Update the Operational Risk Management System (ORMS) with control assurance observations and findings and perform tracking until the observation is closed out
• Perform review on IT polices and standards regularly to ensure adherence to parent bank and regulatory requirements
• Maintain technology control library, perform gap analysis on risk control against policies and standards
• Coordinate with the IT teams to conduct gap analysis on new regulatory requirements
• Tracking of ITG’s monthly and quarterly KRIs for management reporting
• Prepare meeting materials for IT management committee, document and minute the committee’s decisions and perform status tracking

1. Education Qualification

• Bachelor or Master Degree in Information Technology, Computer Science, or Engineering.

2. Working Experiences

• 4-6 years+ experience working with senior stakeholders, business units in IT governance or operational risk functions
• Solid experience in third party risk assessment and vendor management is a plus
• Ability to influence peers and stakeholders to foster and uplift risk culture across ITG
• Ability to execute control assurance review activities with some supervision
• Good decision-making capabilities with a proven track record to weigh the relative consequences of potential actions to inform decisions

3. Professional / HKMA Enhanced Competency Framework Qualification/ Professional Examination/ License

• ISACA/ ISC2 certified (e.g. CRISC, CISA, CISM, CISSP) is highly regarded
• Certification in ISO, ITIL, ISMS, COBIT is an advantage