The ideal candidate should be self-motivated and has hands-on experience in technology governance, technology and cybersecurity risk management, validation, and controls. He/she is expected to provide guidance and advisories, and to raise awareness around technology and cybersecurity risks and control posture in SGX and its subsidiaries (“SGX”).
Responsibilities
• Work with various technology teams in SGX to ensure comprehensive identification and management of technology and cyber risks. This will involve designing improvement programs to uplift cybersecurity hygiene and response readiness of SGX.
• Conduct regular review of SGX Technology Risk Register to align with Enterprise Risk Management guidelines and key risks identified by the management.
• Monitor and validate the performance and effectiveness of technology and operations controls and measures implemented by the technology teams, and work with them to resolve any discrepancies/gaps identified.
• Facilitate and perform Control Self-Assessment for Technology and Cyber Risks.
• Liaise with internal and external auditors and regulators for audit field work and track the compliance and remediation of audit findings.
• Supports SGX subsidiaries on technology and cyber controls and alignment to SGX IT baseline policies. Work with the subsidiaries on exceptions or deviations handling, including tracking of any remediation action plans till completion.
• Ensure continued upkeep of subsidiaries technology risk posture and provide regular management reporting and updates on the status of subsidiaries technology risk.
• Design and implement accurate and actionable dashboard to improve visibility of technology and cyber risks to management.
• Design and implement programs to uplift the risk culture and cybersecurity awareness across SGX.
Qualifications
• Bachelor’s degree with majors in IT/Banking & Finance/ Risk Management/ Cybersecurity/ Technology Governance or Data Analytics.
• At least 8 years of relevant working experience with good exposure to IT security policies, IT Risk Management Framework, Audit and Compliance, Vendor due diligence including Cloud deployment risk assessment, security operations, Data Loss Protection (DLP) and security testing.
• Proficient in Cybersecurity Risk Management Frameworks (example NIST, ISO27000, CIS) and regulatory requirements, namely IOSCO, MAS TRMG, CSA CCOP, GDPR and SEBI.
• Preferably experienced in Archer, BI Tools (such as Tableau, Power BI, Alteryx), Programming/Scripting Languages (such as SQL, Python).
• Certification such as CRISC, CISM, CISA would be advantageous.
• Strong analytical and problem-solving skills and ability to think up innovative ideas to solve problems and challenges.
• Strong verbal and written communication skills, with good ability to interact and influence different stakeholders.
• Able to manage and work with vendors and consultants to deliver programs and projects wherever applicable.
