ICT Risk Officer, Risk & Compliance at GA Insurance

Job Summary:

• To identify, assess, monitor, and report ICT and technology risks across the organization. The ICT Risk Officer provides independent oversight of technology-related risks, ensuring that ICT risks are effectively managed in line with the organization’s risk appetite, regulatory requirements, and business objectives.

Key Responsibilities

ICT Risk Management

• Develop and maintain the ICT risk management framework.
• Conduct ICT risk assessments across systems, projects, infrastructure, and third-party service providers.
• Maintain the ICT Risk Register and monitor risk treatment plans.
• Assess emerging technology risks, including cloud, digital transformation, AI, and cyber risks.

Risk Monitoring and Reporting

• Monitor Key Risk Indicators (KRIs) relating to ICT.
• Prepare monthly, quarterly, and annual ICT risk reports.
• Escalate significant technology risks to management and relevant committees.
• Track and report risk mitigation actions.

Security Operations

• Monitor the organization’s security posture and controls.
• Investigate and manage information security incidents.
• Review vulnerability assessments and remediation activities.
• Monitor security tools such as SIEM, EDR, DLP, firewalls, and endpoint security solutions.

Governance and Compliance

• Ensure compliance with regulatory requirements relating to technology risk.
• Support risk reviews for new systems and projects.
• Participate in business continuity and disaster recovery assessments.
• Support internal and external audits relating to ICT risk.

Third-Party Risk Management

• Assess technology risks associated with vendors and service providers.
• Review ICT-related contractual and control requirements.
• Monitor outsourced technology services for emerging risks.

Risk Awareness

• Promote risk awareness across ICT and business functions.
• Provide guidance on risk assessments and control effectiveness.

Key Performance Indicators (KPIs)

• Percentage of ICT risks assessed and reviewed.
• Closure rate of ICT risk mitigation actions.
• Reduction in high-risk ICT findings.
• Timeliness and quality of risk reports.
• Regulatory compliance rating.

Qualifications

• Bachelor’s Degree in Information Technology, Computer Science, Information Systems, Risk Management, or related field.

Professional certification such as:

• CRISC
• CISA
• CGEIT
• ISO 31000 Risk Management
• CISSP

Experience

• Over 3 years’ experience in ICT Risk, Technology Audit, IT Governance, or Enterprise Risk Management.
• Experience in regulated industries is desirable.

Competencies

• Risk assessment and analysis.
• Governance and regulatory compliance.
• Technology risk management.
• Report writing and communication.
• Stakeholder management.