Specialist: Information and Technology Risk

Purpose Statement

To provide independent oversight, advice and assistance to the business in the identification, evaluation, assessment and treatment of information and technology related risks.
To improve risk awareness and risk culture through challenging first-line management's information and technology risk management practices.

ExperienceMinimum:

5 or more years' experience in Risk Management and/or Internal/ External Auditing.
Proven experience in a governance and oversight capacity, e.g. IT Governance, IT Audit or Information Security
Proven experience and understanding of Cyber and IT Security best practice and principles.

Ideal:

Banking industry experience and knowledge
Experience in data privacy and related compliance, e.g. RDARR, DAMA, GDPR
Prior experience in a Cyber or IT Security role, e.g. ISO role, cyber security role, IT auditor (IT Security specialisation)
5+ years' specialist experience within risk and compliance

Qualifications (Minimum)

Qualifications (Ideal or Preferred)

KnowledgeMinimum:

Experience applying/ Basic understanding of relevant risk methodologies and IT/ Cyber Security control frameworks, e.g. COBIT, ISF, ISO, NIST, ITIL, COSO, DAMA, DM-BOK
Experience in performing risk and control assessments
Experience in information risk management
Experience in IT risk management including information security
General business acumen
Understanding of IT/ Cyber Security and Cloud Computing

Ideal:

Banking industry experience and knowledge, including BCBS-239 (RDARR principles)
Experience in Information Technology Audit and Continuous Auditing techniques
Understanding of Data Management practices
Knowledge of leading practices and regulatory requirements

Skills

Conditions of Employment