Business Function
Technology and Operations (T&O) enables and empowers the bank with an efficient, nimble and resilient infrastructure through a strategic focus on productivity, quality & control, technology, people capability and innovation. In T&O, we manage the majority of the Bank's operational processes and inspire to delight our business partners through our multiple banking delivery channels.
Job Objectives
The T&O COO Office plays a critical role in enhancing the Bank's focus on enterprise-wide risk management, driving firm-wide strategic initiatives in procurement and business continuity preparation, and fostering workforce engagement and development ready for digital transformation across our operational functions. This department is central to maintaining a robust control environment and adapting to the evolving regulatory landscape.
This role will lead the convergence of Operational Risk Management and Technology Risk Management. The team is dedicated to driving effective operational risk management in the digital age, utilizing a consistent operational risk control framework that leverages advanced data analytics. This includes overseeing risk governance forums and implementing improvement programs across all operational functional levels. The TRM function focuses on proactively identifying, assessing, and mitigating technology-related risks across the organization, ensuring the resilience and security of our technology landscape, including emerging technologies such as Generative AI and Public Cloud. This role will also oversee the New Product Approval team, ensuring a streamlined and rigorous risk assessment process for all new offerings.
Responsibilities
As Team Head of Technology and Operational Risk Management, you will be responsible for providing strategic leadership and executive oversight, encompassing the following:
- Strategic Leadership & Risk Culture Champion:
- Formulate and execute a comprehensive strategy for Technology and Operational Risk Management within the HK T&O unit, aligning with group-level objectives and regulatory expectations
- Act as the primary champion for the risk culture agenda across the HK T&O unit, fostering a strong, proactive, and embedded risk-aware mindset among all staff
- Lead and inspire both the Operational Risk Management and Technology Risk Management teams, setting strategic direction, empowering staff development, and ensuring high performance
- Represent HK T&O at all major local and regional risk forums, committees, and regulatory engagements, effectively communicating the unit's risk posture and mitigation strategies
- Drive the continuous enhancement of the risk management framework, policies, and procedures across both operational and technology domains, ensuring alignment with industry best practices and evolving regulatory requirements (e.g., HKMA's TM-E-1, TM-G-1, SA-2, C-RAF)
- Operational & Technology Resilience:
- Lead the development and implementation of robust operational resilience frameworks, encompassing both technology and non-technology risks, with a strong emphasis on third-party risk management and critical business services
- Oversee the end-to-end management of third-party risk, including due diligence, ongoing monitoring, and incident response, ensuring the resilience of critical services outsourced to vendors
- Drive initiatives to identify, assess, and mitigate technology risks across various domains, including Site Reliability Engineering, Emerging Technology (e.g., Generative AI, Public Cloud), in partnership with Group and Local Technology, Cybersecurity and Risk Management functions
- Develop and implement proactive strategies for managing and enhancing the resilience of critical banking services, ensuring business continuity and minimal disruption during unforeseen events
- Oversee the investigation, analysis, and advisory on significant risk events and material technology incidents, ensuring root causes are identified and effective mitigation strategies are implemented
- Risk Governance & Oversight:
- Provide executive oversight and strategic guidance for the unit's Risk and Control Self-Assessment (RCSA) programme, ensuring thorough risk identification, assessment methodologies, and effective control implementation across both operational and technology landscapes
- Direct the collation, monitoring, and comprehensive reporting of Key Risk Indicators (KRIs) for the unit, providing insightful analysis and actionable recommendations to senior management and risk committees
- Lead the New Product Approval team, streamlining processes and ensuring comprehensive risk assessments are conducted for all new products and services in close collaboration with BU/SU stakeholders
- Ensure timely coordination and completion of all operational and technology risk-related regulatory submissions, compliance reviews, and audit engagements
- Oversee the tracking and monitoring of risk issues and the completion status of corrective actions, holding relevant teams accountable for timely remediation
- Stakeholder Engagement & Advisory:
- Cultivate strong relationships with senior leaders across Operations units, Technology teams, Business Units, and Support Units to embed risk management practices and foster a collaborative risk culture
- Provide expert technology and operational risk subject matter guidance and advisory to T&O and line of business teams, supporting strategic initiatives and change management
- Engage proactively with technology stakeholders to identify detailed and technical risks, ensuring effective remediation activities and continuous improvement of the IT risk posture
- Liaise effectively with legal and compliance, internal and external auditors, regulators, and regulatory agencies on risk and compliance reviews pertaining to T&O activities
- Provide guidance on operational and technology risk management best practices, emerging risks, and regulatory changes to the unit and relevant stakeholders
Requirements
- Experience & Leadership:
- Demonstrated progressive experience in risk management within a financial services or banking environment at senior leadership role overseeing both operational and technology risk functions
- Proven track record of strategic leadership, team management, and influencing senior stakeholders in a complex organizational structure
- Demonstrated expertise in managing operational risk and technology risk in a large-scale financial institution, with comprehensive knowledge and experience in operational processes, controls, and technology infrastructure
- Extensive experience in regulatory engagement and a deep understanding of regulatory requirements, particularly those set forth by the HKMA (e.g., TM-E-1, TM-G-1, SA-2, C-RAF)
- Technical & Domain Expertise:
- Strong understanding of Information Security, System Resiliency & Availability, Software Development practices and frameworks
- In-depth knowledge of emerging technologies such as Generative AI and Public Cloud, and their associated risks
- Expertise in developing and implementing frameworks for governance, risk, and control, as well as operationalizing processes and procedures
- Proficiency in risk assessment methodologies, including RCSA, KRI development, and incident management
- Demonstrated experience in managing third-party risk and ensuring the resilience of critical business services
- Education & Certifications:
- Degree holder (or equivalent) in Risk Management, Information Systems, Finance, Business Administration, or a related discipline
- Relevant professional certifications such as CISA, CISSP, CISM, CRISC, ECF-ORM are highly advantageous
- Skills & Attributes:
- Exceptional strategic thinking and problem-solving skills, with the ability to identify, analyze, and address complex, multi-faceted operational and technology risks
- Superior communication, presentation, and stakeholder management skills, with the ability to influence, negotiate, and collaborate effectively with diverse cross-functional teams and senior executives
- Proven ability to foster and lead a strong risk culture, driving awareness and accountability across the organization
- High integrity, professional work practice, and a strong commitment to ethical conduct
- Ability to be competent people manager capable of handling multiple priorities and thrive in a dynamic, fast-paced environment
Apply Now
We offer a competitive salary and benefits package and the professional advantages of a dynamic environment that supports your development and recognizes your achievements.
We regret that only shortlisted candidates will be notified.
Location:
Two Harbour Square
Job:
Risk Management.
Schedule:
Regular
Employee Status:
Full time
