AVP - IT Risk and Control - IT

Location:
HKEX - TKO

Shift:
Standard - 40 Hours (Hong Kong SAR)

Scheduled Weekly Hours:
40

Worker Type:
Permanent

Job Summary:
This role is for an experienced IT professional to join the IT Risk and Control (ITRC) focusing on risk and control activities for the Information Technology Division (ITD).

Job Duties:

Responsibilities:

• Proactively monitors of ITD's risk landscape and control environment regarding all ITD processes, timely reports risk and issue events, and track for closure
• Assesses the execution of technology controls while considering the changing risk and regulatory landscape
• Provides guidance regarding control-gap remediation and compensating controls, oversees action plans and resolution of control issues/breaks with ITD functions to address security, risk and control gaps
• Promotes IT policy awareness, monitors and/or tracks and reports on compliance with established IT control policies, process, and procedures.

• Ensure risks impacting ITD is effectively identified, quantified, communicated and managed, including identifying the root cause/key themes, development of control options, recommendations for resolution, and risk reporting
• Ensure key risks impacting controls audits are addressed prior to initiation of audits
• Track, monitor and verify remediation and/or control implementation by ITD functions for appropriate closure of identified risks and issues
• Prepare risk and control dashboards and reports for management reporting
• Work with ITD functions and relevant stakeholders to gather control design requirements and facilitate discussions
• Evaluate the functionality of existing and new technology platforms to drive adherence to HKEX policies and IT standards
• Maintain a set of IT registers managed by ITRC supporting risk and control activities within ITD
• Examine results of internal/external audits for potential cross-impacts on ITD functions or other programs
• Work with Subject Matter Experts to deliver awareness trainings on control requirements stated in IT standards and relevant industry best practices, and ensure quality, accuracy and consistency of training content
• Perform control assessment and reviews based on defined methodology, IT standards and/or industry good practice, and produce proper documentation on the results and reports
• Collaborate on internal and external technology audits, and 2nd Line deep dives and testing
• Exhibit a continuous learning mindset for education & awareness on IT risk and control concepts

Requirements:

• Bachelor's degree (or equivalent) in information technology or related disciplines
• CGEIT, CRISC, CISA and/or CISSP is preferred
• 8 - 10 years of experience in Technology 1.5 Line at a large multinational financial institution
• 5+ years of experience in technology risk & control including but not limited to policies and standards, risk and control assessments, access controls, key focus review program creation, control remediation, regulatory compliance, technology resiliency, risk and control governance and metrics, incident management, cloud computing, development lifecycles, vulnerability management and data protection
• Solid understanding of internal control concepts with the ability to evaluate and determine the adequacy of controls by considering business and technology risks in an integrated manner
• Experience conducting infrastructure, application, or business process reviews is required; and
• Good knowledge of NIST Cybersecurity Framework, ITIL, CMMI, ITSM, COBIT, and PMBOK
• Knowledge of system development life cycle concepts with an ability to quickly learn a complex, distributed computing environment
• Knowledge of distributed technologies considered a plus, along with a good understanding of controls related to operating system and database platforms
• Ability to manage multiple tasks concurrently in an efficient and effective manner with minimal supervision
• Critical Thinking (anticipates problems and establishes methods to mitigate project/program risks), detail oriented and strong sense of accountability and ownership
• Strong analytical skills including solving and communicating complex problems, data analytics, measurement and reporting needed to continuous improvement
• Excellent verbal and written communications skills in English, including the ability to effectively participate in and lead discussions and meetings
• Team player who works well individually and in teams, shares information and collaborates with colleagues
• Enthusiastic, self-motivated, strong interest in learning, effective under pressure

Company Introduction:

Hong Kong Exchanges and Clearing Limited (HKEX) is one of the world's major exchange groups, and operates a range of equity, commodity, fixed income and currency markets. HKEX is the world's leading IPO market and as Hong Kong's only securities and derivatives exchange and sole operator of its clearing houses, it is uniquely placed to offer regional and international investors access to Asia's most vibrant markets.

As the global markets leader in the Asian time-zone, we offer a world of opportunities for early careers and experienced hires. Here, we know that diverse thinking fosters better solutions, and we are committed to building an open and dynamic environment which allows our business to innovate and our people to thrive.

Discover the latest career opportunities and programmes at HKEX.

HKEX is committed as an Equal Opportunity Employer. Diversity is one of our core values and we look to support, respect diverse perspectives, abilities, culture and experiences within our workplace.