Tìm việc làm IT

Position Overview:

• Develop, implement, and enhance the organization-wide integrated risk management framework, focusing on technology, operational, enterprise, third-party risks, and operational resilience.
• Act as a specialist responsible for conducting independent analysis, assessment, and monitoring, providing evidence-based challenge to the first line’s risk assessments and risk acceptance decisions.
• Independently oversee risks across infrastructure, core banking, digital banking, payments, cloud, APIs, data, AI, and emerging technologies throughout the entire technology lifecycle.
• Operate RCSA, KRI/KCI, scenario analysis, incident/loss management, and remediation tracking; consolidate the organization-wide risk profile to identify concentration risks and cascading impacts.
• Assess risks associated with new products, material changes, digital transformation projects, and vendors/third parties; provide independent risk opinions before approval.
• Report integrated risks, early warnings, and recommendations to Executive Management, the Risk Committee, and the Board of Directors; promote a risk management culture.

Key Responsibilities:

1. Technology Risk and Operational Risk Management

• Develop and maintain the Technology Risk & Operational Risk Management Framework, taxonomy, assessment methodologies, KRIs, limits, and alert thresholds.
• Conduct independent second-line oversight of infrastructure, networks, databases, core banking, digital banking, payments, cloud, APIs, DevSecOps, and data platforms.
• Organize RCSA by business unit/process/system; develop a risk-control library, loss database, and control issue register.

2. Operational Resilience

• Develop the Operational Resilience Framework; identify critical business services and the maximum tolerable level of disruption.
• Map dependencies across people, processes, technology, data, and vendors; establish impact tolerances, RTO, and RPO.
• Independently assess BCP, DRP, crisis management, backup, and data recovery capabilities; coordinate severe but plausible scenario exercises.

3. Enterprise and Integrated Risk Management

• Review and enhance the Enterprise Risk Management Framework; maintain the risk universe, taxonomy, and enterprise risk profile.
• Coordinate the development of the Risk Appetite Framework, limits, warning indicators, and escalation mechanisms.
• Link risk–control–asset–process–service–incident–finding within the GRC platform; develop integrated dashboards and heatmaps to identify concentration risks and emerging risks.

4. Third-Party Risk and Incident Management

• Conduct/challenge due diligence, periodic assessments, and continuous monitoring of vendors based on their criticality; develop exit strategies and contingency plans.
• Establish severity classification and escalation criteria for operational, technology, data, and cybersecurity incidents.
• Ensure that incidents are recorded, undergo root cause analysis, have assigned owners and remediation deadlines; analyze trends to identify systemic weaknesses.

5. Risk Reporting, Risk Data, and Compliance

• Develop KRI/KPI/KCI metrics, dashboards, and periodic/ad hoc reports for the CRO, Executive Management, the Risk Committee, and the Board of Directors.
• Establish risk data standards covering completeness, accuracy, timeliness, and traceability; coordinate the automation of data collection and alerts.
• Translate legal requirements, State Bank of Vietnam (SBV) regulations, and relevant standards into policies, standards, and controls; track remediation actions arising from audits/inspections.

6. Advisory, Risk Culture, and Other Duties as Assigned by the Line Manager

• Act as a risk advisory partner to business, technology, and operations leaders; conduct evidence-based independent challenge.
• Provide training on RCSA, KRI, incident management, Technology Risk, and Operational Resilience; develop a network of risk champions across business units.

Job Requirements:

• Bachelor’s degree or higher in Risk Management, Finance and Banking, Information Systems, Information Technology, Information Security, Data Science, Auditing, or a related field.
• At least 6 years of risk management experience in banking, finance, insurance, securities, payment intermediaries, fintech, Big Four firms, or professional consulting.
• At least 6 years of direct professional experience in risk management (technology/operational/enterprise/integrated) within the second line of defense.
• In-depth understanding of Operational Risk, Technology Risk, ERM, internal controls, and the Three Lines of Defense model.
• Knowledge of the architecture and operations of core banking, digital banking, payment systems, APIs, cloud, data platforms, infrastructure, networks, and enterprise applications.
• Strong knowledge of RCSA, KRI/KCI, control testing, risk acceptance, issue/loss event management, scenario analysis, and root cause analysis.
• Understanding of BCP, DR, operational resilience, impact tolerance, RTO/RPO, and third-party risk; knowledge of Basel, ISO 31000, COSO ERM, COBIT, NIST CSF, ISO/IEC 27001, and ISO 22301.

Benefits:

• Competitive salary package (Base salary and performance bonuses).
• Probation period salary is 100% of the official salary.
• Comprehensive health and accident insurance.
• 15 days of annual leave, 3 remote work days per month.
• Provision of work equipment (Macbook/ Laptop, mouse, monitor, etc.).
• A creative and modern working environment.

Working location: Galaxy Innovation Hub – D1 Hi Tech Park, Tang Nhon Phu Ward, HCMC

Kindly send your CV to: [email protected]