SVP VP Team Head Technology and Operational Risk Management

You will provide strategic leadership for technology and operational risk management, establish risk strategy and culture, and lead the operational and technology risk functions. You will strengthen risk frameworks, resilience, third-party risk controls, risk assessments, reporting, new-product approvals, regulatory submissions, audits, and remediation. You will advise senior stakeholders on technology and operational risks, regulatory changes, and risk-management practices.

Responsibilities

• Formulate and execute technology and operational risk management strategy
• Champion a proactive risk culture
• Lead operational and technology risk management functions
• Represent the unit at risk forums, committees, and regulatory engagements
• Enhance risk frameworks, policies, and procedures
• Develop and implement operational resilience frameworks
• Oversee third-party due diligence, monitoring, and incident response
• Identify, assess, and mitigate technology risks including risks related to generative AI and public cloud
• Manage resilience of critical banking services and business continuity
• Oversee investigation and mitigation of significant risk events and technology incidents
• Provide oversight of the RCSA programme and control implementation
• Monitor and report key risk indicators
• Lead new-product approval risk assessments
• Coordinate regulatory submissions, compliance reviews, and audit engagements
• Track risk issues and corrective-action remediation
• Provide risk advisory to operational, technology, business, and support stakeholders

Requirements

• Senior leadership experience in operational and technology risk management within financial services or banking
• Strategic leadership, team management, and senior stakeholder influence experience
• Expertise in operational processes, controls, and technology infrastructure
• Regulatory engagement experience and knowledge of HKMA requirements including TM-E-1, TM-G-1, SA-2, and C-RAF
• Knowledge of information security, system resiliency, availability, and software development practices
• Knowledge of generative AI, public cloud, and associated risks
• Governance, risk, and control framework expertise
• Risk assessment, RCSA, KRI development, and incident management expertise
• Third-party risk management and critical-service resilience experience
• Degree or equivalent in Risk Management, Information Systems, Finance, Business Administration, or a related discipline
• CISA, CISSP, CISM, CRISC, or ECF-ORM certification is advantageous
• Strategic thinking, problem-solving, communication, presentation, stakeholder management, negotiation, and collaboration skills