Information Technology Risk Manager

IT Risk & Data Risk Specialist

Responsibilities:

• Implement IT Risk Management policies, procedures, standards, and guidelines to effectively manage IT and Data Risk.
• Conduct and perform IT RCA (Risk and Control Assessment) with control testing and follow up the action plan, perform CRAF (Cyber Resilience Assessment Framework), and RLA (Risk Level Assessment) processes.
• Provide recommendations and consultation to IT Risk owners regarding products, processes, and operations related to IT Risk.
• Support the design and execution of supervisory stress testing for IT risks, ensuring compliance with regulatory requirements.
• Oversee the annual review of ISO 27001 compliance and provide guidance to IT risk owners.
• Review and assess IT risks for new products, providing recommendations to mitigate potential risks.
• Investigate and analyze root causes of IT incidents, providing insights and solutions for improvement.
• Support IT and Data Risk Management team by contributing initiatives.
• Prepare IT risk reports for management and external regulators as required.
• Evaluate and provide recommendations on IT Project and IT Third-Party Risk Assessments and ensure compliance with regulations.
• Participate in Business Continuity Management (BCM) activities, including disaster recovery plan exercises to ensure operational resilience.
• Perform additional tasks assigned by the supervisor.

Qualifications:

• Bachelor’s or Master’s degree in related or equivalent domain, preferably in IT, Cybersecurity, Computer Engineering, Computer Science.
• At least 5-8 years of experience in IT Risk Management, IT Security, IT Audit, Data Governance, MIS, or related fields.
• Experience in banking, financial services, or consulting firms is required.
• Strong understanding of IT Risk Management, Data Risk, IT governance, Cybersecurity and related fields.
• Good knowledge and understanding related laws and regulations.
• Excellent interpersonal, analytical, presentation, and communication skills.
• High awareness of emerging data protection tools, methodologies, and technology trends.