Department: Protective Services Unit/ Risk Management Department

Main Role (Overall accountability): The Head of Cyber Risk Governance is primarily accountable for operating cyber governance within the Second Line of Defence (2LOD). This includes driving the definition and maintenance of the Bank's cyber governance system, risk methodology, and Unified Control Library (UCL), as well as ensuring the cyber framework aligns with enterprise risk management and regulatory requirements.

Principal Accountabilities:

• Defines and maintains the Tech/Cyber Enterprise Risk Framework Service, risk taxonomy, and methodologies (e.g., risk thresholds, impact/likelihood scales).
• Facilitates the setting and maintenance of the Cyber Risk Appetite & Tolerances Service, including thresholds and breach handling.
• Acts as the primary Control Objective Owner in the UCL.
• Owns Policy Creation and Approval Service, defining principles and rules.
• Own and oversees the Policy Exception Management Framework.
• Defines and maintains the UCL.
• Performs Horizon Scanning service - proactively identifying emerging risks, regulatory expectations and analysing their impact on the risk and control framework.
• Monitors compensating controls, tracks exception lifecycle, and escalates overdue or high-risk exceptions.
• Manages the Technology & Cyber Risk Committee Secretariat & Governance Service (agenda, minutes, actions).
• Provides Methodology & Tooling Enablement Service - training, guidance, and templates for 1LOD risk assessments.
• Facilitates Control Objective Clinics Service to ensure 1LOD/1.5LOD understanding of control requirements.
• Manages the quality assurance process for 2LOD activities.

Desired Candidate Profile

Personnel Specifications:

• 15+ years in cyber/technology risk governance, policy development, or security management within financial services
• Experience in non-financial risk management and control framework development and regulatory compliance
• Track record of engaging with regulators
• Experience establishing governance structures and committees
• Bachelor's degree in Information Technology, Computer Science, or related field
• CISA certification required or in progress
• CISSP or CISM advantageous
• Knowledge of ISO 27001, NIST CSF