Key Responsibilities

1. Cyber Risk Oversight & Governance

• Lead the independent oversight of cyber and technology risks across the Group in line with the Bank’s Enterprise Risk Management Framework.
• Establish and maintain cyber risk management policies, standards, and frameworks aligned to regulatory expectations and industry best practices.
• Provide effective advisory to the First Line (Group Technology) on risk identification, mitigation plans, and control effectiveness.

2. Regulatory Compliance & Engagement

• Ensure full compliance with regulatory requirements, including BNM Risk Management in Technology (RMiT), SC guidelines, and Bursa requirements.
• Act as the central coordination point for regulatory reviews, audits, and submissions relating to cyber and technology risk.
• Monitor regulatory developments and ensure timely implementation of new requirements across the Group.

3. Risk Assessment & Monitoring

• Oversee the execution of cyber risk assessments, including IT risk assessments, vulnerability management oversight, and cyber resilience reviews.
• Review and challenge risk and control self-assessments (RCSAs), key risk indicators (KRIs), and risk reporting provided by the First Line.
• Ensure material risks are escalated appropriately to senior management and relevant governance committees.

4. Incident Oversight & Cyber Resilience

• Provide oversight of major cyber incidents and ensure appropriate escalation, response, and post-incident review.
• Assess the adequacy of incident response, disaster recovery, and business continuity plans from a cyber risk perspective.
• Ensure lessons learned from incidents are embedded into risk mitigation strategies.

5. Stakeholder Management & Advisory

• Serve as a trusted risk advisor to Group Technology, senior management, and business units on cyber risk matters.
• Engage with internal stakeholders including Compliance, Internal Audit, and Business Units to ensure a coordinated risk management approach.
• Present cyber risk insights, issues, and recommendations to senior management committees (e.g., Risk Management Committee, Board-level committees).

6. Team Leadership & Capability Building

• Lead, develop, and mentor the Cyber Risk Management team to ensure strong technical and risk management capabilities.
• Drive a culture of risk awareness and accountability across the organisation.
• Ensure adequate resources, tools, and skillsets are in place to support evolving cyber risk landscape.