Job Description

To provide independent second-line oversight, advisory, challenge and monitoring across the overlapping risk domains of Information Risk, Data Privacy, Business Resilience, Technology Risk and Cyber Risk. The role will support the Head of Non-Financial Risk by localising Group frameworks and standards, embedding risk appetite, facilitating risk assessments and scenario analysis, coordinating assurance and remediation, and producing integrated risk insights for management and governance committees. The role is not the first-line owner of risk execution; it enables, challenges and monitors business and technology risk owners to ensure risks are identified, assessed, treated, reported and escalated within appetite

This is a strategic second-line risk position for an experienced professional with the ability to translate complex and interconnected risk themes into actionable insights and governance outcomes. The role requires a strong balance of technical credibility, business pragmatism, and stakeholder influence to support growth ambitions while maintaining robust protection of clients, information assets, technology infrastructure, critical services, and regulatory confidence.

Qualifications

Type of Qualification: First Degree

Field of Study: Information Technology, Computer Science, Information Risk Management, Information Security, Business, Commerce, Law, Finance, Audit or related discipline.

Professional / Technical Certifications: At least one relevant certification is preferred

• Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Security Professional (CISSP), ITIL, ISO 22301, ISO 27001, Certified Data Protection Officer or equivalent

Experience Required

7-8 years

Additional Information

Behavioural Competencies:

• Articulating Information
• Developing Expertise
• Documenting Facts
• Examining Information
• Following Procedures
• Interacting with People
• Managing Tasks

Technical Competencies:

• Evaluating Risk Management Effectiveness
• Information Security
• Information Security Management
• Cyber and Technology Risk Oversight
• Analytical Skills
• Risk Response Strategy

• Provide independent second-line oversight, advisory, challenge and monitoring across the overlapping risk domains of Information Risk, Data Privacy, Business Resilience, Technology Risk and Cyber Risk.
• Support the Head of Non-Financial Risk by localising Group frameworks and standards, embedding risk appetite, facilitating risk assessments and scenario analysis, coordinating assurance and remediation, and producing integrated risk insights for management and governance committees.
• Enable, challenge and monitor business and technology risk owners to ensure risks are identified, assessed, treated, reported and escalated within appetite.
• Translate complex and interconnected risk themes into actionable insights and governance outcomes.
• Support growth ambitions while maintaining robust protection of clients, information assets, technology infrastructure, critical services, and regulatory confidence.

• Information security risk
• Business continuity
• Crisis management
• Operational resilience
• Information Risk
• Data Privacy
• Business Resilience
• Technology Risk
• Cyber Risk
• Operational Risk
• IT Audit
• Technology Governance
• Business Continuity
• Governance writing
• Analytical capability
• Stakeholder influence
• Risk systems and collaboration tools

• First Degree in Information Technology, Computer Science, Information Risk Management, Information Security, Business, Commerce, Law, Finance, Audit or related discipline.
• At least one relevant professional/technical certification (e.g., CISA, CISM, CRISC, CISSP, ITIL, ISO 22301, ISO 27001, Certified Data Protection Officer or equivalent).
• Strong understanding of Non-Financial Risk as a second-line function.
• Demonstrable experience in at least three of the following domains: Information Risk, Data Privacy, Business Resilience, Technology Risk, Cyber Risk, Operational Risk, IT Audit, Technology Governance or Business Continuity.
• Ability to interpret Group standards and regulatory expectations and translate them into practical country implementation actions.
• Strong governance writing capability.
• Strong analytical capability and attention to detail.
• Ability to influence senior stakeholders and provide constructive challenge.
• High integrity, confidentiality, independence, professional scepticism and sound judgement.
• Working knowledge of risk systems and collaboration tools (e.g., Risk Market Place, Microsoft Excel, PowerPoint, Word and Teams).