Job Summary

• The role is primarily responsible for identification of emerging and existing risks through a country lens aligning with the Group and Regional requirements from Operations, Technology & Cyber risk perspective as first line of defence. The activities that require a Client-Journey agnostic or consolidated approach will be horizontally managed by the role. Responsible for monitoring control effectiveness as it relates to Local Regulatory Reporting, Country Conduct Plan, Data Governance and Cybersecurity

• In addition to the Risk & Control (R&C) responsibilities, the role performs the responsibilities of Information Security Officer and Business Resilience Management with includes supporting cyber security governance, technology risk oversight, operational resilience, audit management and regulatory engagement. 

• The role coordinates mandatory risk forums, regulatory reporting governance, risk reporting to various committees and forums in country and the Group.

Key Responsibilities

Strategy
• Supports the Country Chief Technology Operations Officer (CTOO) in Risk Control Owner (RCO)/Process Owner (PO) responsibilities in accordance with the Enterprise Risk Management Framework.
• In collaboration with Conduct Financial Crime Compliance (CFCC), identify, communicate and expedite changes to comply with any new and amended regulations across Technology & Operations (T&O).
• Represent Group R&C from country level for implementation of standards, continuous improvement programs and strategic transformations. 
• Additional responsibility of Country Information Security Officer (CISO) aligning to Group CISO function for supporting CTOO on Information & Cyber Security Risk Management and regulatory compliance.
• Identify and independently drive strategic change initiatives to deliver on the Information and Cyber Security (ICS) agenda with a forward-looking view.
• Develop insightful strategies for engaging business on information security matters, ensure investments are prioritised and funding is approved.
• Additional responsibility of Country Business Resilience Management for supporting CTOO on Crisis Management, Disaster Recovery and Business Continuity.
• Put on country lens, review the risk from Client Journey (CJ) Ops agnostic perspective identifying country top themes / trends, emerging risks. 
• Ensure country adheres to policy requirement, challenge where risk remain unresolved and fulfil country conduct plan.
• Monitor country "risk hygiene / quality assurance" across CJ Ops.
• Ensure compliance to Reg reporting Policy / standard in line with Compliance Risk Type Framework.
• Liase with regulator, to facilitate/represent CTOO.
• Support CTOO in Data governance at country level. 
• Establish and maintain a community of Department Continuity Coordinators (DCC's) across the country for the development, maintenance, and testing of Business Continuity plans for all departments 
• Establish and maintain a Business Continuity strategy in line with Group standards, to ensure recovery capability is in place to meet the needs of business across country locations

Business & Processes
• Audit of Technology, Business Continuity, Data & Non Financial Regulatory Reporting (NFRR) Co-ordination (Group + Regulatory) - whilst the primary responsibility for every audit will remain with the respective Unit Head, R&C will be expected to play a critical role. Every Record of Findings (RoF) and quality of its management response will have to be vetted by R&C to ensure that the findings are factually correct and the agreed action plans, along with target dates, are reasonable and achievable.
• Audit Issue Tracking & Closure - track aging of findings and ensure periodic follow-up. Keep audit informed of progress and ensure any delays in resolution are appropriately approved before due date.
• Support/lead as applicable - key thematic risk reviews/mitigation projects i.e. data quality/confidentiality, outsourcing, End User Computing (EUC), user access, Stability, Change Quality, Frauds, Financial Crime Risk, Regulatory etc. within applicable units.
• Conduct risk and Information & Cyber Security Awareness Sessions, Road shows and Training programs for the pan bank staffs on a periodic basis
• Ensure ICS risks in country are proactively managed and effectively controlled, mitigated and remediated with senior stakeholder’s support and buy-in, in line with Group, Region, Country, Business/Function risk appetite and regulatory driven requirements.
• Ensure that the management of ICS risk is effective and operating efficiently in the respective business / function.
• Assist in driving security culture/awareness and help improve readiness for a cyber event.

• Ensure information risks are identified, assessed, mitigated and controlled.
• Ensure Critical Information Assets are identified and graded appropriately.  Monitor changes in the risk profile of the highly critical systems.
• Work with IT to validate the resilience of data and IT systems.
• Support Group initiatives ensuring the respective business / function / region needs are represented effectively.
• Address Group Internal Audit (GIA) queries related to ICS and address GIA Request For Information (RFI)s for ICS strategy, standards, controls and ICS tools.
• Ensure Department Continuity Coordinator (DCC)s are appropriately trained in their Business Continuity duties, and provide support and guidance as required.
• Manage compliance and reporting against Business Continuity Manager (BCM) key controls 
• Notify Regional / Group BCM of all Business Continuity Plan (BCP) related audit activity in country
• Monitor local regulatory body for BCM requirements and report on compliance / gaps to functional management
• Maintain a BCM activity schedule for the country.
• Delivery of an effective Crisis Management framework 
• Be responsible for maintaining BCP sites (including host/refugee, common area locations), to ensure that they are available and functional for use in the event of an emergency situation
• Provide timely MIS to functional management on activities, tests, and incidents across the country.

People & Talent
• Ensure that the relevant staff understand and accept their responsibilities in relation to risks, governance and controls.
• Ensure that direct report(s) are suitably skilled and qualified for their roles ensuring that they have effective supervision in place to mitigate any risks.

Fair Accountability
• Support Fair Accountability Process - based on incident Root Cause Analysis (RCA) lead and support fair accountability at the appropriate unit level closely working with HR where needed.  

Risk Management
• Regulatory interface for T&O Related issues/matters. 
• Mass Incident Management and RCA and closure - assessment of Mission Control/high severity technology incidents, raising of route cause and follow-up on closure of action plans for the responsible units in coordination with T&O units.
Risk Management through Standardised MI:
• Review of Audit failure/issues/action plans - identify cross border issues, track and resolve.
• Feedback into engineering Group - regular review of controls to improve design towards automation and preventive management.
• Conduct a threat/stress & scenario-based assessment and update Risk Register
• Review open regulatory risks and assess/agree treatment plans

End User Computing (EUC) Management
• Ensure Group policy is well circulated.
• Provide an oversight over the central repository of EUC register and ensure it is kept up to date.
• Support the country CTOO in assessing any dispensation requests. 
• Provide an oversight over any dispensations obtained/granted and ensure these are kept up to date.

Incident Management: Root Cause Analysis
• Identify and define the problem (operational loss, audit failure, near miss, significant event, high severity incidents).
• Update Risk Register/Agree Treatment Plan and follow-up for closure.

Risk Governance Representation and Preparation of Risk Packs
• T&O Non-Financial Risk Forum
• Data Governance forum (Includes Regulatory Return Governance as well).
• Information & Cyber Security Working Group.
• Focal T&O liaison point to Country Head Operations, Technology and Cyber Risk (OTCR). 
• Represent T&O in country Enterprise Risk Committee (ERC) and other meetings – where necessary.
• Paper preparation & submission to Board Audit Committee, Board Risk Committee & Board Meeting – where necessary. 

Governance
• Coordinate Data Governance Forum (DGF) meetings, action plans and support any data remediation efforts along with Regulatory Reporting (RR) related issues requiring remediation/attention. Any risks identified from data-based risks or to be raised to ERC for discussion, acceptance and treatment plans as per Enterprise Risk Management Framework (ERMF). 

Regulatory & Business Conduct
• Display exemplary conduct and live by the Group’s Values and Code of Conduct. 
• Take personal responsibility for embedding the highest standards of ethics, including regulatory and business conduct, across Standard Chartered Bank. This includes understanding and ensuring compliance with, in letter and spirit, all applicable laws, regulations, guidelines and the Group Code of Conduct.
• Effectively and collaboratively identify, escalate, mitigate and resolve risk, conduct and compliance matters.

Key stakeholders
Internal:
• Country Management Team
• Group Heads, T&O Risk & Controls. 
• Group Architecture & Product Engineering teams
• Group & Country Technology teams
• Group & Country OTCR Head.
• Business/Functional & Cluster/Regional CISO
• Cluster Head Business Resilience. 
• Crisis Management Support Team. 
• Active Threat Monitoring Team. 
• Client & Third-Party Support Team. 
• Cyber Defence Center 
• Country T&O Team. 

External:
• Regulators, Law Enforcement Agencies, and other Government Ministries & departments/officials.
• Industry partners, Banking Associations, etc
• External Auditors

Other Responsibilities
• Embed Here for good and Group’s brand and values in Nepal T&O Risk & Control; Perform other responsibilities assigned under Group, Country, Business or Functional policies and procedures; Multiple functions  [(a) Country Information Security Officer (b) Country Business Resilience Manager.]

Skills and Experience

• Information & Cyber Security
• Technology Risk Management
• Data Management
• Enterprise Risk Management
• Banking Operations
• Banking Products

Qualifications

• Master's Degree in Engineering, Computer Science/Information Technology or its equivalent.
• Strong knowledge of ICS products and operations will be preferred.
• Ability to articulate gross and residual risk with specific ability to communicate complex technology and process risk clearly, concisely and accurately to non-technical stakeholders in a lucid way.
• Strong interpersonal and stakeholder management skills, across various levels in the organization including senior leadership teams, in influencing key decisions taken in the business and in support teams.
• Strong communication skills – oral, written and presentation. 
• Must be a self-starter who is able to initiate and successfully drive programs and projects to completion with little or no management supervision.
• Strong analytical skills and ability to prioritise, make decisions, and work to tight timeframes.
• Strong business acumen and deep knowledge and experience in the ICS field.
• Proven ability to lead highly complex, global activities through influence and credibility rather than command and control.
• Ability to both assess strategic priorities and to focus on detailed aspects of a function in order to drive effective delivery.
• Strong integrity, independence, and resilience.
• One or more of the following certifications will be preferred:
a. Certified Information Security Manager (CISM)
b. Certified Information Systems Security Professional (CISSP)
c. SANS Global Information Assurance Certifications (GIAC)
d. Certified in Risk & Information Systems Control (CRISC)
e. Certified Information Systems Auditor (CISA)

About Standard Chartered

We're an international bank, nimble enough to act, big enough for impact. For more than 170 years, we've worked to make a positive difference for our clients, communities, and each other. We question the status quo, love a challenge and enjoy finding new opportunities to grow and do better than before. If you're looking for a career with purpose and you want to work for a bank making a difference, we want to hear from you. You can count on us to celebrate your unique talents and we can't wait to see the talents you can bring us.

Our purpose, to drive commerce and prosperity through our unique diversity, together with our brand promise, to be here for good are achieved by how we each live our valued behaviours. When you work with us, you'll see how we value difference and advocate inclusion.

Together we:

• Do the right thing and are assertive, challenge one another, and live with integrity, while putting the client at the heart of what we do
• Never settle, continuously striving to improve and innovate, keeping things simple and learning from doing well, and not so well
• Are better together, we can be ourselves, be inclusive, see more good in others, and work collectively to build for the long term

What we offer

In line with our Fair Pay Charter, we offer a competitive salary and benefits to support your mental, physical, financial and social wellbeing.

• Core bank funding for retirement savings, medical and life insurance, with flexible and voluntary benefits available in some locations.
• Time-off including annual leave, parental/maternity (20 weeks) and volunteering leave (3 days), along with minimum global standards for annual and public holiday, which is combined to 30 days minimum
• Proactive wellbeing support through Unmind, a market-leading digital wellbeing platform, development courses for resilience and other human skills, global Employee Assistance Programme, sick leave, mental health first-aiders and all sorts of self-help toolkits
• A continuous learning culture to support your growth, with opportunities to reskill and upskill and access to physical, virtual and digital learning.
• Being part of an inclusive and values driven organisation, one that embraces and celebrates our unique diversity, across our teams, business functions and geographies - everyone feels respected and can realise their full potential.