Tech Risk Officer

Job Summary

The Technology Risk Officer is responsible for executing second-line technology and cyber risk management activities across the Bank's digital platforms. The role performs IT risk assessments, control design and effectiveness reviews, IT Risk and Control Self-Assessment (IT RCSA), technology KRI monitoring, and produces technology risk reporting for management and governance committees in line with BOT IT risk and cyber resilience requirements.

Key Responsibilities

• Perform technology and cyber risk assessments and execute IT Risk and Control Self-Assessment (IT RCSA) cycles
• Assess and monitor technology control domains and maintain the IT risk register
• Define, collect, validate, and analyse technology Key Risk Indicators and escalate breaches and adverse trends
• Provide second-line review and challenge of major changes including risk assessment of implementation plans.
• Perform independent review of technology and cyber incidents
• Support technology risk assessment of new products, features, channels, and material architecture changes;
• Support digital operational resilience activities in coordination with BCM and Operational Risk: critical business service mapping.
• Support cloud and third party technology risk reviews in coordination with Third Party Risk.
• Maintain the technology risk issue and action log, monitor overdue items and risk acceptances, and escalate ageing or deteriorating issues
• Prepare technology risk reporting, dashboards, and committee materials for management, RMC, and ROC; contribute to regulatory submissions, BOT examination responses, and audit requests
• Promote technology risk awareness across organization and support enhancement of technology risk methodology

Qualifications

Experience

• 3–7 years of experience in technology risk, IT audit, information security, cyber risk, IT governance, or IT compliance
• Hands-on experience performing IT risk assessments, IT RCSA, or IT control testing
• Experience in banking, payments, or fintech environments; exposure to digital or virtual banking platforms is an advantage
• Experience with cloud environments and API-based architectures is an advantage
• Exposure to incident management, vulnerability management, or IT DR testing is an advantage

Technical Skills

• Working knowledge of technology risk and control frameworks (NIST CSF, ISO 27001/27002, COBIT, CIS Controls, Three Lines of Defense)
• Practical understanding of IT general controls, application controls, cloud security controls, and secure SDLC/DevSecOps practices
• Competence in risk and control documentation, control testing techniques, and evidence-based finding write-up
• Strong analytical thinking, problem-solving, and attention to detail
• Good communication and stakeholder management skills, with the ability to explain technology risk to non-technical audiences
• Good command of English and Thai