Role
Purpose
The
Executive, Technology Risk Management supports the Group's Cyber &
Technology Risk Management function by assisting in the monitoring, assessment,
reporting and governance of technology risks across CTOS Digital Group.
The
role is responsible for maintaining technology risk records, monitoring key
risk indicators (KRIs), tracking remediation activities, supporting governance
reporting, coordinating risk assessments, and overseeing the closure of
technology risk actions. The position operates within the Second Line of
Defence and does not own, operate, or administer technology infrastructure,
cybersecurity controls, cloud platforms, applications, or technology
operations.
Key
Responsibilities
Technology
Risk Monitoring & Administration
- Maintain
technology risk registers, issue registers and risk acceptance records.
- Monitor and update
technology risk action plans, remediation trackers and management action
plans.
- Follow up with
action owners on overdue risk treatment activities.
- Support periodic
technology risk assessments and risk profile reviews.
- Maintain
governance documentation, policies, standards and records.
- Support the
administration of technology resilience and operational risk records.
Risk
Reporting & Governance
- Prepare technology
risk dashboards, KRIs and management reports.
- Compile risk
metrics and management information for reporting to Management and Board
Committees.
- Assist in
preparing committee papers, presentations and governance materials.
- Track governance
decisions, risk issues and action items.
- Perform trend
analysis on technology incidents, outages and operational resilience
metrics.
Audit,
Regulatory & Compliance Monitoring
- Maintain registers
relating to audit findings, regulatory observations and independent
assessments.
- Monitor
remediation progress and escalate overdue actions where necessary.
- Support evidence
collection, validation and closure activities.
- Assist in
regulatory engagements and compliance reporting.
- Maintain
documentation required for internal and external reviews.
Technology
Risk & Resilience Oversight
- Support reviews of
technology risks across infrastructure, applications, cloud services and
technology projects.
- Monitor risks
relating to system availability, disaster recovery, cyber resilience and
technology obsolescence.
- Track remediation
arising from technology incidents and service disruptions.
- Maintain records
relating to disaster recovery tests and business continuity exercises.
- Support
resilience-related assessments and reporting.
Change,
Project & Third-Party Risk Management
- Support risk
reviews of significant technology projects, system implementations and
technology changes.
- Monitor technology
project risks, change-related issues and remediation activities.
- Assist in
technology vendor and outsourced service provider risk assessments.
- Maintain
third-party technology risk registers and monitoring records.
- Track completion
of vendor remediation plans and assessment activities.
Technology
Incident & Risk Event Monitoring
- Record and monitor
technology incidents, service disruptions and technology risk events.
- Track closure of
corrective and preventive actions.
- Assist in root
cause analysis reviews and lessons learned tracking.
- Prepare management
reporting on incident trends and recurring issues.
Risk
Culture & Stakeholder Support
- Support technology
risk awareness and communication initiatives.
- Assist in
coordinating technology risk training and awareness programmes.
- Engage with
Technology, Security, Compliance and Business stakeholders on risk
governance requirements.
- Support
implementation of technology risk management initiatives and continuous
improvements.
Key
Accountabilities
The
incumbent is accountable for:
- Accuracy and
completeness of technology risk registers, trackers and governance
records.
- Timely monitoring
and reporting of technology risk issues.
- Effective tracking
of audit, regulatory and assessment findings.
- Quality and
timeliness of technology risk reporting and management information.
- Maintenance of
risk documentation, evidence repositories and governance artefacts.