Information Technology Risk Manager

About the Role

As the Technology and Third-Party Risk Head , you will lead the development and oversight of the organization's Technology Risk Management and Third-Party Risk Management frameworks.

You'll work independently as part of the Second Line of Defense , partnering with Technology, Information Security, Legal, Compliance, Internal Audit, and business units to identify, assess, monitor, and mitigate technology and outsourcing risks.

Key Responsibilities

• Develop and maintain the Technology Risk Management Framework.
• Conduct independent technology risk assessments across applications, infrastructure, cloud services, and digital initiatives.
• Oversee cyber security and information security risk governance.
• Monitor technology risk indicators and provide recommendations to senior management.
• Lead Third-Party Risk Management activities, including vendor due diligence and ongoing risk assessments.
• Evaluate outsourced service providers, cloud providers, fintech partners, and other third parties.
• Develop technology and third-party risk policies, standards, and procedures.
• Support Board Risk Oversight Committee and management committees through risk reporting.
• Monitor regulatory developments related to technology, cyber security, outsourcing, and information security.
• Participate in reviews of technology incidents, cyber security events, and major service disruptions.
• Recommend proactive risk mitigation strategies and monitor remediation activities.

Must-Have Qualifications

• Bachelor's degree in Information Technology, Computer Science, Information Systems, Cyber Security, Engineering, Business, or a related field.
• 7–10 years of experience in Technology Risk Management, Information Security Risk, Cyber Security Risk, Third-Party Risk Management, or Outsourcing Risk.
• Experience gained within a bank, fintech, or financial institution .
• Experience conducting independent risk assessments for technology projects, cloud environments, cyber security controls, and outsourced service providers.
• Strong professional writing skills with experience drafting governance documents, policies, and standard operating procedures.
• Ability to communicate technical risk findings to non-technical stakeholders.
• Willing to work onsite in Taguig City .

Good-to-Have

• Previous people management or project leadership experience.
• Professional certifications such as:
• CRISC
• CISA
• CISSP
• CISM
• ISO/IEC 27001 Lead Implementer or Lead Auditor
• COBIT Foundation or COBIT Design & Implementation
• Certified Third-Party Risk Professional (CTPRP)