Manager/Senior Manager - Technology Risk

Report to: Head of Technology and Operational Risk

Responsibilities

• Develop, implement and maintain a comprehensive technology risk management framework, policies and procedures to identify, assess, manage and report risk, in alignment with industry best practices and regulatory standards.
• Support the delivery of strategic projects and initiatives to enhance the bank’s technology risk management capabilities.
• Assess the effectiveness of controls in place and provide recommendations for improvement, in alignment with relevant regulatory circulars and guidelines.
• Identify and escalate technology risks within the bank, facilitate appropriate risk mitigation actions where necessary.
• Prepare insightful technology risk reports, threat landscape analysis, and risk analysis to risk governance committees and senior management.
• Establish and maintain strong relationships with internal and external stakeholders, act as 2LoD subject matter expert, provide advice to IT, operation, business teams.
• Conduct thorough risk assessments, including but not limited to, RCSA, new product assessments, critical third-party risk assessments, cloud architecture and security reviews, AI/GenAI adoption and use case reviews and scenario testing exercises to ensure continuous improvement and effectiveness.
• Establish and monitor risk appetite metrics and key risk indicators to quantify potential risk and impacts on the bank's operational environment.
• Support HKMA examinations, thematic reviews and self-assessments.

Qualifications

• Bachelor’s degree preferably in Information Technology, Computer Science, Risk Management or related discipline.
• Minimum 5 years of relevant experience in the financial institution or consultancy, with a focus on technology risk management preferred.
• Practical knowledge in regulatory requirements and control frameworks such as C-RAF, TM-C-1, TM-E-1, TM-G-1, TM-G-2, OR-2, SA-2 published by the HKMA, PCI-DSS, SWIFT Customer Security Programme etc.
• Solid understanding of modern technology stacks, cloud architectures, ML/AI/GenAI frameworks.
• A good team player with sound interpersonal and communication skills, fluency in written and spoken English and Chinese is essential for regulatory correspondence and cross-team collaboration.
• Holder of professional qualifications such as CISSP, CISA, CISM, CRISC or other equivalent is preferred.

Mandatory Reference Checking Scheme

Mandatory Reference Checking Scheme (MRC Scheme) may be applicable for certain relevant positions. It is a standardised reference-checking arrangement that is designed to support the integrity of "authorized institutions" regulated by the Hong Kong Monetary Authority (HKMA). Pursuant to the MRC scheme, our Bank will conduct a mandatory reference check by requesting information from each relevant former and current employer of applicants. For more details about the MRC Scheme, please visit the website of the Hong Kong Association of Banks: https://www.hkab.org.hk/en/page/5/mandatory-reference-checking-scheme-phase-2

Applicants who are not invited for an interview within the 8 weeks after submission of application may assume their applications are unsuccessful. We may review applications received for suitability for other posts within the Company. All personal data provided will be treated in strict confidence and used strictly for recruitment-related purposes only. We shall retain the personal data of unsuccessful applicants for a period of 24 months upon receipt of such application.