Manager (Risk & Controls, CISO and Business Resilience Management)

Job Summary • The role is primarily responsible for identification of emerging and existing risks through a country lens aligning with the Group and Regional

from Operations, Technology & Cyber risk perspective as first line of defence. The activities that require a Client-Journey agnostic or consolidated approach will be horizontally managed by the role. Responsible for monitoring control effectiveness as it relates to Local Regulatory Reporting, Country Conduct Plan, Data Governance and Cybersecurity • In addition to the Risk & Control (R&C)

, the role performs the responsibilities of Information Security Officer and Business Resilience Management with includes supporting cyber security governance, technology risk oversight, operational resilience, audit management and regulatory engagement. • The role coordinates mandatory risk forums, regulatory reporting governance, risk reporting to various committees and forums in country and the Group.

Strategy • Supports the Country Chief Technology Operations Officer (CTOO) in Risk Control Owner (RCO)/Process Owner (PO) responsibilities in accordance with the Enterprise Risk Management Framework. • In collaboration with Conduct Financial Crime Compliance (CFCC), identify, communicate and expedite changes to comply with any new and amended regulations across Technology & Operations (T&O). • Represent Group R&C from country level for implementation of standards, continuous improvement programs and strategic transformations. • Additional responsibility of Country Information Security Officer (CISO) aligning to Group CISO function for supporting CTOO on Information & Cyber Security Risk Management and regulatory compliance. • Identify and independently drive strategic change initiatives to deliver on the Information and Cyber Security (ICS) agenda with a forward-looking view. • Develop insightful strategies for engaging business on information security matters, ensure investments are prioritised and funding is approved. • Additional responsibility of Country Business Resilience Management for supporting CTOO on Crisis Management, Disaster Recovery and Business Continuity. • Put on country lens, review the risk from Client Journey (CJ) Ops agnostic perspective identifying country top themes / trends, emerging risks. • Ensure country adheres to policy requirement, challenge where risk remain unresolved and fulfil country conduct plan. • Monitor country "risk hygiene / quality assurance" across CJ Ops. • Ensure compliance to Reg reporting Policy / standard in line with Compliance Risk Type Framework. • Liase with regulator, to facilitate/represent CTOO. • Support CTOO in Data governance at country level. • Establish and maintain a community of Department Continuity Coordinators (DCC's) across the country for the development, maintenance, and testing of Business Continuity plans for all departments • Establish and maintain a Business Continuity strategy in line with Group standards, to ensure recovery capability is in place to meet the needs of business across country locations Business & Processes • Audit of Technology, Business Continuity, Data & Non Financial Regulatory Reporting (NFRR) Co-ordination (Group + Regulatory) - whilst the primary responsibility for every audit will remain with the respective Unit Head, R&C will be expected to play a critical role. Every Record of Findings (RoF) and quality of its management response will have to be vetted by R&C to ensure that the findings are factually correct and the agreed action plans, along with target dates, are reasonable and achievable. • Audit Issue Tracking & Closure - track aging of findings and ensure periodic follow-up. Keep audit informed of progress and ensure any delays in resolution are appropriately approved before due date. • Support/lead as applicable - key thematic risk reviews/mitigation projects i.e. data quality/confidentiality, outsourcing, End User Computing (EUC), user access, Stability, Change Quality, Frauds, Financial Crime Risk, Regulatory etc. within applicable units. • Conduct risk and Information & Cyber Security Awareness Sessions, Road shows and Training programs for the pan bank staffs on a periodic basis • Ensure ICS risks in country are proactively managed and effectively controlled, mitigated and remediated with senior stakeholder’s support and buy-in, in line with Group, Region, Country, Business/Function risk appetite and regulatory driven requirements. • Ensure that the management of ICS risk is effective and operating efficiently in the respective business / function. • Assist in driving security culture/awareness and help improve readiness for a cyber event. • Ensure information risks are identified, assessed, mitigated and controlled. • Ensure Critical Information Assets are identified and graded appropriately.

Monitor changes in the risk profile of the highly critical systems. • Work with IT to validate the resilience of data and IT systems. • Support Group initiatives ensuring the respective business / function / region needs are represented effectively. • Address Group Internal Audit (GIA) queries related to ICS and address GIA Request For Information (RFI)s for ICS strategy, standards, controls and ICS tools. • Ensure Department Continuity Coordinator (DCC)s are appropriately trained in their Business Continuity duties, and provide support and guidance as required. • Manage compliance and reporting against Business Continuity Manager (BCM) key controls • Notify Regional / Group BCM of all Business Continuity Plan (BCP) related audit activity in country • Monitor local regulatory body for BCM requirements and report on compliance / gaps to functional management • Maintain a BCM activity schedule for the country. • Delivery of an effective Crisis Management framework • Be responsible for maintaining BCP sites (including host/refugee, common area locations), to ensure that they are available and functional fo