Operational Risk Manager

Responsibilities

• Develop, implement, and maintain the Bank’s Operational Risk Management (ORM) framework and operational resilience framework, including supporting policies, procedures, systems, and tools
• Assess the effectiveness of existing controls and provide recommendations for enhancement in alignment with HKMA Supervisory Policy Manual and regulatory expectations
• Drive and coordinate Risk and Control Self-Assessment (RCSA) and Key Risk Indicator (KRI) processes, strengthening risk identification, assessment methodologies, and monitoring practices
• Manage the review and analysis of operational risk events, incident trends, and significant incidents, including root cause analysis and implementation of effective mitigation measures
• Conduct thematic reviews of operational processes, provide input into product due diligence, and deliver risk advisory support for new products and services
• Perform risk data analysis and maintain high-quality operational loss data to support risk insights, trend analysis, and data-driven decision-making
• Track and monitor risk issues and action plans, ensuring timely remediation and closure of identified gaps
• Support Business Continuity Management (BCM) and operational resilience initiatives, including BIA, maintenance of critical operations, BCP drills and scenario testing
• Oversee the coordination and governance of New Product Committee (NPC) activities, including organizing meetings, maintaining centralized records of product/service approvals, tracking completion of the review, and ensuring documentation is properly archived for audit and independent review
• Prepare timely and accurate monthly and ad hoc operational risk reports for senior management and Risk Committees
• Promote risk awareness and provide training to business units to strengthen risk culture and ensure continuous improvement of operational risk management practices
• Contribute to outsourcing and third-party risk management as well as regulatory initiatives (e.g., ICAAP, HKMA reporting)

Requirement:

• Bachelor's degree, preferably in Information Technology, Finance, Risk Management, or a related discipline.
• A minimum of 5 years of relevant experience in the financial sector or consultancy, focusing on operational risk management. Having an Associated Operational Risk Management Professional (AORP) or Certified Operational Risk Management Professional (CORP) certification is an advantage.
• Practical experience and knowledge of risk management frameworks and methodologies.
• Familiarity with control frameworks such as OR-1, OR-2, TM-G-2, IC-1, SA-2 published by the HKMA.
• Strong understanding of risk assessment methodologies, industry best practices, and emerging trends in risk management.
• Excellent analytical, problem-solving, and decision-making skills.
• Exceptional communication, presentation, and interpersonal skills.
• Ability to work independently and manage multiple tasks effectively.
• Good command of spoken and written English and Chinese (including Putonghua).

Mandatory Reference Checking Scheme

Mandatory Reference Checking Scheme (MRC Scheme) may be applicable for certain relevant positions. It is a standardised reference-checking arrangement that is designed to support the integrity of "authorized institutions" regulated by the Hong Kong Monetary Authority (HKMA). Pursuant to the MRC scheme, our Bank will conduct a mandatory reference check by requesting information from each relevant former and current employer of applicants. For more details about the MRC Scheme, please visit the website of the Hong Kong Association of Banks: https://www.hkab.org.hk/en/page/5/mandatory-reference-checking-scheme-phase-2

Applicants who are not invited for an interview within the 8 weeks after submission of application may assume their applications are unsuccessful. We may review applications received for suitability for other posts within the Company. All personal data provided will be treated in strict confidence and used strictly for recruitment-related purposes only. We shall retain the personal data of unsuccessful applicants for a period of 24 months upon receipt of such application.