Tech
Manager (Technology Risk Management)
Major Responsibilities
Provide overall coordination of technology risk management processes
Assist in development and implementation of risk management framework, strategies, policies, standards, guidelines and procedures in technology risk-related aspects
Liaise with business units on risk identification, design and implementation of control measures and monitoring of the on-going effectiveness of internal controls over information technology risk, cyber security risk, third party risk and business continuity management
Assist in implementation and maintenance of the company-wide Information Security Management System (“ISMS”) in compliance with the ISO/IEC 27001 standard
Coordinate and conduct risk assessments and thematic reviews on existing and new services
Coordinate with business units to support internal and external audits and regulatory compliance assessments
Assist business units in remediation of internal control weaknesses identified in audit reviews and assessments
Prepare regular reporting and metrics to present the technology risk posture of the company
Provide advice to business units on the company’s new initiatives and existing operations from technology risk and control perspective
Perform other duties as assigned by supervisor(s)
Requirements
University degree preferably in computer science, information technology, information system or related disciplines
Minimum 5 years of experience in technology risk management, information security, IT auditing or related fields, preferably with experience from financial institutions or professional consulting firms
Knowledgeable in the practices and standards commonly adopted by the banking/financial industry related to technology risk management such as HKMA SPMs & C-RAF, NIST
cybersecurity framework and ISO/IEC 27001 standard
CISA, CISM, CRISC, CISSP and/or other equivalent certifications is preferable
Good analytical, interpersonal, communication and presentation skills
Good command of written and spoken English and Chinese
Candidates with less experience may be considered as Deputy Manager (Technology Risk Management)
