Department Description
Reporting within the Global Business Service Unit (GBSU) to the IT Risk And Production Management (RPM) department, the Data & Cybersecurity (DCS) team is responsible for securing and steering Information Security and Cybersecurity related risks falling under Global Banking & Investor Solutions' (GBIS) remit.
Responsibilities:
The Regional Cyber Governance, Risk, and Compliance (GRC) Officer is responsible for overseeing the cybersecurity framework across the Asia Pacific region, with a strong emphasis on regulatory compliance in APAC countries. This role holds a key responsibility in assessing, overseeing, and advising on cyber regulation compliance. The Regional Cyber GRC Officer leads the response to regulatory inquiries, manages cybersecurity awareness initiatives, and supervises overall cyber governance across various Asian markets.
- Conduct and manage cyber risk assessments, audits, and regular monitoring to proactively identify and mitigate risks.
- Drive the company-wide cybersecurity awareness program, providing training and resources to ensure staff remains informed about current threats and best practices.
- Ensure adherence to all relevant regulatory compliance standards, including liaising with legal and compliance teams to stay updated on emerging legislations.
- Maintain close interaction with regulators for all aspects related to Information systems and Technology.
- Lead internal response on Cybersecurity towards regulatory requests, RISQ / audit /inspection or regular submissions ensuring timely and accurate reporting and communication.
- Monitor and ensure compliance (coordinate gap analysis and follow-up remediation plans) against local regulations, global policies, and standards related to Cybersecurity.
- Oversee the cyber risk governance over Asian countries, being the Regional point of contact for cyber security correspondents in the various countries.
- Coordinate across various departments to integrate cybersecurity best practices and compliance into broader corporate governance.
- Regularly report to senior management on the status of cybersecurity governance, risk management, and compliance activities.
- Evaluate and manage regional security exceptions in alignment with global standards
Profile Required:
Academic Background and Certifications, Experience
- Bachelor's degree in information technology or equivalent
- Professional qualification in information security management such as CISSP, CISM, CISA
- Minimum of 10 years of experience in cybersecurity with a focus on governance, risk management, and compliance, preferably with multi-country responsibilities in the Asia Pacific region.
Operational Skills
- Extensive knowledge of the regulatory environment and data protection laws within the Asia Pacific region.
- Proven ability to interact with regulators and other external parties on information securty matters.
- Proven track record of developing and executing successful cybersecurity awareness programs.
- Experience in conducting and managing risk assessments, interpreting results, and developing strategies to mitigate identified risks.
- Strong leadership skills with experience with cross-functional global teams and working with senior stakeholders
- Excellent communication and interpersonal skills, with an ability to translate complex technical information for a non-technical audience.
- Fluent in English.
- Client oriented mindset, results driven, proactive and quick to react to requests
- Innovative and bringing new ideas to improve processes.
Behavioral Skills
- Client - Understanding and Respect: I listen to clients and colleagues in order to understand and anticipate their needs
- Team Spirit - Open mindset: I listen and share my views and my expertise in an open mode
- Innovation - Technology: I adopt new technologies in the solutions and projects I work on
- Responsibility - Risk awareness: I am constantly on the lookout for risks
- Responsibility - Performance: I strive for high performance
- Commitment - Exemplarity: I embody the Group’s values
We regret to inform that only shortlisted candidate will be notified.
