Assistant Vice President, Information & IT Security Risk Management

JOB PURPOSE

• This role is responsible to add values to strategic and operational decisions by assessing and identifying risks that could impact the success of the company. Primarily focus on evaluating the risk-return implications, threats and opportunities and potential trade-offs, specifically with regards to the risk governance. Support the Risk Management Department in ensuring that risks are identified, assessed, managed /mitigated, monitored and reported timely.

JOB RESPONSIBILITIES

• Leading to perform any data, information security and technology related risk assessment to ensure control effectiveness for the applications, infrastructure and technology related projects.
• Provide advisory on data, information security and technology related matters and review security technologies such as firewall, encryption, and intrusion detection / prevention systems.
• Perform analysis to identify, integrate and establish monitoring risk indicators to ensure all the priority risk areas activities are consistent and align with the company directions / objectives.
• Conduct risk assessment and vulnerability analysis on the information security, data privacy, technology infrastructure, operational process, proactively address potential threats also support the management to strengthen the existing practices.
• Experience / understand of cloud infrastructure, open-source technology, robotic automation, artificial intelligence, machine learning, any other projects and outsourcing activities to perform risk assessment which include vendor, third and fourth party, etc related activities.
• Able to articulate complex concepts in generic terms to business leaders and what the risk areas / key highlights and impacts to the business.
• Act as an administrator / coordinate to collaborate with other departments to ensure business and system continuity are integrated with in all the critical business functions and conduct necessary testing to validate the effectiveness of the business continuity, disaster recovery process.
• Handle all the IT related logs and incidents reporting, and response planning related activities and provide suitable guidance / advise to mitigate the matters.
• Support to develop and review the company risk profile, business recovery, business continuity and crisis mitigation plan to provide assurance to respective management and board committees that principal risk are identified, evaluated, mitigated and system are in place to respond and recover from any business disruption which can impact to the business strategies / objectives.
• Monitor the execution of the approved mitigation / improvement plan arising from risk register, risk review, risk analysis and risk assessment and ensure that action plans are effectively executed and validated.
• Develop, implement, and review the effectiveness of the group and entities risk management program, governance (including reporting structure, documentation, etc.), methodologies in a comprehensive manner
• Prepare papers / slides and provide strategic insights on risk matters from the review / analysis and reports to the senior management and relevant committees.
• Work directly with the business units to facilitate risk assessment and risk management processes.
• Collaborate with management team and provide inputs in the formulation of stress testing scenarios and capital modeling exercise.
• Develop and prepare all risk management reports such as monthly risk management dashboard, security health check dashboard, risk review, and others related reports.
• Drive and conduct Priority Risk Workshop and eRM training.
• Execute the Risk Management annual plan
• Enhance internal processes and continuously develop and enhance risk dashboards, templates, and reports
• Partner with business units across the entity to raise awareness of risk management concerns.
• Provide guidance and training for team members.
• Support and participate in the integration of ESG risk into risk management
• Support and participate in Group Risk Management as well as group wide initiatives, projects and programs
• Assume responsibility of other relevant tasks / ad hoc projects as assigned

QUALIFICATIONS AND EXPERIENCE

Academic

• Bachelor’s degree in Information Technology, Computer Science, Cybersecurity, IT Risk Management, or related discipline

Professional

• Any IT risk related certification such as CISSP, CISS, CISM, CEH, CRISC; or
• Business Continuity Management certification; or
• Business process improvement certification; or
• Project management related certification.

Experience

• More than 6 years of working experience in (re) insurance and (re) takaful
• Experience in compliance framework (e.g. SOC 1, SOC 2) information security framework (e.g. ISO 27001, NIST, CIS) regulatory compliance (e,g, AML / KYC).