Position Overview:
- Develop, implement, and enhance the organization-wide integrated risk management framework, focusing on technology, operational, enterprise, third-party risks, and operational resilience.
- Act as a specialist responsible for conducting independent analysis, assessment, and monitoring, providing evidence-based challenge to the first line’s risk assessments and risk acceptance decisions.
- Independently oversee risks across infrastructure, core banking, digital banking, payments, cloud, APIs, data, AI, and emerging technologies throughout the entire technology lifecycle.
- Operate RCSA, KRI/KCI, scenario analysis, incident/loss management, and remediation tracking; consolidate the organization-wide risk profile to identify concentration risks and cascading impacts.
- Assess risks associated with new products, material changes, digital transformation projects, and vendors/third parties; provide independent risk opinions before approval.
- Report integrated risks, early warnings, and recommendations to Executive Management, the Risk Committee, and the Board of Directors; promote a risk management culture.
Key Responsibilities:
1. Technology Risk and Operational Risk Management
- Develop and maintain the Technology Risk & Operational Risk Management Framework, taxonomy, assessment methodologies, KRIs, limits, and alert thresholds.
- Conduct independent second-line oversight of infrastructure, networks, databases, core banking, digital banking, payments, cloud, APIs, DevSecOps, and data platforms.
- Organize RCSA by business unit/process/system; develop a risk-control library, loss database, and control issue register.
2. Operational Resilience
- Develop the Operational Resilience Framework; identify critical business services and the maximum tolerable level of disruption.
- Map dependencies across people, processes, technology, data, and vendors; establish impact tolerances, RTO, and RPO.
- Independently assess BCP, DRP, crisis management, backup, and data recovery capabilities; coordinate severe but plausible scenario exercises.
3. Enterprise and Integrated Risk Management
- Review and enhance the Enterprise Risk Management Framework; maintain the risk universe, taxonomy, and enterprise risk profile.
- Coordinate the development of the Risk Appetite Framework, limits, warning indicators, and escalation mechanisms.
- Link risk–control–asset–process–service–incident–finding within the GRC platform; develop integrated dashboards and heatmaps to identify concentration risks and emerging risks.
4. Third-Party Risk and Incident Management
- Conduct/challenge due diligence, periodic assessments, and continuous monitoring of vendors based on their criticality; develop exit strategies and contingency plans.
- Establish severity classification and escalation criteria for operational, technology, data, and cybersecurity incidents.
- Ensure that incidents are recorded, undergo root cause analysis, have assigned owners and remediation deadlines; analyze trends to identify systemic weaknesses.
5. Risk Reporting, Risk Data, and Compliance
- Develop KRI/KPI/KCI metrics, dashboards, and periodic/ad hoc reports for the CRO, Executive Management, the Risk Committee, and the Board of Directors.
- Establish risk data standards covering completeness, accuracy, timeliness, and traceability; coordinate the automation of data collection and alerts.
- Translate legal requirements, State Bank of Vietnam (SBV) regulations, and relevant standards into policies, standards, and controls; track remediation actions arising from audits/inspections.
6. Advisory, Risk Culture, and Other Duties as Assigned by the Line Manager
- Act as a risk advisory partner to business, technology, and operations leaders; conduct evidence-based independent challenge.
- Provide training on RCSA, KRI, incident management, Technology Risk, and Operational Resilience; develop a network of risk champions across business units.
Job Requirements:
- Bachelor’s degree or higher in Risk Management, Finance and Banking, Information Systems, Information Technology, Information Security, Data Science, Auditing, or a related field.
- At least 6 years of risk management experience in banking, finance, insurance, securities, payment intermediaries, fintech, Big Four firms, or professional consulting.
- At least 6 years of direct professional experience in risk management (technology/operational/enterprise/integrated) within the second line of defense.
- In-depth understanding of Operational Risk, Technology Risk, ERM, internal controls, and the Three Lines of Defense model.
- Knowledge of the architecture and operations of core banking, digital banking, payment systems, APIs, cloud, data platforms, infrastructure, networks, and enterprise applications.
- Strong knowledge of RCSA, KRI/KCI, control testing, risk acceptance, issue/loss event management, scenario analysis, and root cause analysis.
- Understanding of BCP, DR, operational resilience, impact tolerance, RTO/RPO, and third-party risk; knowledge of Basel, ISO 31000, COSO ERM, COBIT, NIST CSF, ISO/IEC 27001, and ISO 22301.
Benefits:
- Competitive salary package (Base salary and performance bonuses).
- Probation period salary is 100% of the official salary.
- Comprehensive health and accident insurance.
- 15 days of annual leave, 3 remote work days per month.
- Provision of work equipment (Macbook/ Laptop, mouse, monitor, etc.).
- A creative and modern working environment.
Working location: Galaxy Innovation Hub – D1 Hi Tech Park, Tang Nhon Phu Ward, HCMC
Kindly send your CV to: talent@galaxyholdings.co
