Technology Risk & Compliance Analyst (Contract Renewable)

Job Description:

1. Assist Technology Risk & Compliance Manager in managing technology risk and compliance within DTS communicating the Bank's direction on technology risk & compliance policies to all staff and provides advisory services and support as the Technology Risk Policy Owner (RPO).
2. Complement Risk Management Department (RMD) in facilitating and managing the transversal technology risks across the Bank.
3. Assist with the implementation and enforcement of the Technology Compliance Management Framework within the department.
4. Build and maintain strategic partnership with the Bank's Internal Audit as well as respective IT process owners to ensure conformance to IT and bank-wide compliance requirements.
5. Assist Technology Risk Manager to undertake the role as Risk Policy Owner [RPO] for technology risks in the Bank [2nd line of defence].
6. Assess on the potential technology risks via environmental scanning and keeping abreast of risk trends to facilitate the identification and monitoring of technology transversal risks for the Bank including establishing risk ownership.
7. Evaluate technology risk scenarios reported by the line departments to determine the likelihood and impact of significant technology risks, with key prioritisations. Propose necessary action plans to mitigate transversal technology risks via policy issuance or other risk treatment plans.
8. Assess risk appetite and tolerance levels set by management with the respective significant activity owners and key stakeholders through awareness programs and promote effective management of transversal technology risks.
9. Consolidate and escalate transversal technology risks to RMD and the Bank’s risk oversight committees and provide expertise in technology risk related matters to complement RMD in managing emerging technology risks in the Bank.
10. Assist Technology Risk Manager in managing technology risk and undertaking the role as Line Department Risk Champion [1st line of defence] - [Annual Declaration of IT Risks].
11. Clearly define risk events, causal, existing controls, action plan and assess the likelihood and impact for departmental based on the Bank’s risk taxonomy and risk framework. Identify risks based on the 4As guiding principle – Availability, Accessibility, Agility, Accuracy and recommend risk treatment strategies and plan.
12. Share and provide value-added technology risk assessment advisory and consultancy services to stakeholders via an in-depth understanding of the stakeholder’s business area, anticipating needs of stakeholders, and continuously keeping abreast with developments in technology risk.
13. Share and provide value added technology risk assessment advisory and consultancy services to stakeholders via an in depth understanding of the stakeholder’s business area, anticipating needs of stakeholders, and continuously keeping abreast with developments in technology risk.
14. Assist Technology Compliance Manager to undertake the undertake TG role as 1.5 line of defence and performing compliance review ensuring adherence to bank’s policies and procedures, identifying gaps and ensuring all remediation actions are completed.
15. Provide independent review and facilitate the identification, assessment, and monitoring of mitigation plans for infrastructure and application components ensuring the critical and high-risk gaps are addressed and closed in a timely manner.
16. Participate in conducting self-attestation with respective owner of applications and its related components to ensure all known gaps identified are worked on and prioritised for further action based on key risk areas.
17. Stand guided by the of industry best practices in terms of new policies, standards and guidelines in ensuring IT security and design principles are embedded within solution development lifecycle.
18. Assist in collaboration across departments in managing internal and external audit programs/requests and areas that need correction to the senior management team and prioritising compliance work that requires immediate rectification or urgent escalation.
19. Provide compliance advisory for the department to avoid possible recurrence of audit issues. This is inclusive of revisit of previous action plans to ensure its relevancy for any new emerging risk.