Job Description

Job Purpose:

• Provide independent second-line technology risk oversight, challenge, and advisory for the Bank's Technology Resilience framework.
• Ensure critical technology services, systems, infrastructure, and third-party dependencies supporting Critical Business Services (CBS) are resilient and recoverable.
• Ensure alignment with the Bank's risk appetite, operational resilience objectives, and regulatory requirements.
• Support the Bank's ability to prevent, withstand, respond to, and recover from technology disruptions.
• Strengthen the Bank's overall operational resilience and business continuity capabilities.

Key Responsibilities:

• Advise stakeholders on the design, implementation, and governance of the Technology Resilience framework.
• Support identification of critical systems and technology services supporting Critical Business Services (CBS).
• Contribute to technology risk appetite setting and end-to-end dependency mapping.
• Provide independent risk oversight for disruption prevention, response, recovery, and resilience strategies.
• Review dependency mapping and assess operational resilience vulnerabilities.
• Ensure technology disruption risks are adequately identified and managed.
• Oversee and challenge the mapping of applications, infrastructure, data flows, integrations, and third-party providers supporting CBS.
• Review and challenge the management of critical dependencies and concentration risks.
• Ensure alignment with technology risk appetite, business resilience objectives, and regulatory expectations.
• Provide oversight of DR governance, recovery objectives, failover/failback strategies, and resilience-by-design practices.
• Review DR testing outcomes across on-premises, hybrid, and cloud environments.
• Provide oversight and challenge of resilience and DR testing programs.
• Assess severe but plausible disruption scenarios (e.g., data centre outages, ransomware, cloud failures, critical application failures).
• Review test effectiveness, recovery outcomes, lessons learned, and remediation actions to strengthen resilience.

Job Specification

• Provide independent oversight of technology resilience, disaster recovery, dependency mapping, and recovery planning activities.
• Review resilience risks, recovery capabilities, impact tolerances (RTO, RPO, MTD), and testing outcomes to ensure resilience objectives are met.
• Monitor compliance with resilience policies, risk appetite, and regulatory requirements while reporting key risks and remediation actions.
• Education qualification: Bachelor’s Degree in Information Technology, Engineering, Risk Management, or a related discipline.
• Professional certification: Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Security Professional (CISSP) or Certified Information Security Manager (CISM)
• Preferably within Banking or a regulated financial services environment.
• 7 - 12 years’ experience in technology risk, risk governance, operational risk, or information security.
• Experience across First Line and Second Line roles.
• Technology Risk, Compliance, Audit, and Risk Governance.
• Risk framework management, risk appetite, and regulatory engagement (including BNM RMiT).
• Exposure to third‑party risk, operational risk, and fraud‑related matters.
• Experience preparing governance papers for senior management and Board committees.
• Project management experience supporting governance or risk initiatives.