Non-Financial Risk Expert (DLP & NFRC)

About the role

The CRO division at Julius Baer develops and oversees the global framework for risk identification, control, reporting and management. This role supports the Head of Non-Financial Risk Control (NFRC) Asia in policy, governance, incident management, operations, internal controls, risk advisory and electronic discovery (e-forensics) for Asia, working closely with global counterparts in Switzerland and with Front, IT, Corporate Services and other functions.

Key responsibilities

• DLP: maintain, operate and optimise data-at-rest and data-in-motion controls across Asia; review and enhance DLP policies against business needs, regulation and information security standards
• Oversee DLP platform upgrades, releases and migrations, and monitor, investigate and close DLP alerts and incidents, including end-to-end case management
• Deliver DLP incident metrics, trend analysis and breach reports, and support governance, roadmap planning and ad-hoc regulatory projects
• Support NFR Asia investigations, maintain and update information security policies and guidelines, and advise on new initiatives
• Support internal and external audits, and provide advisory on client identifying data, cross-border transfers, data ownership, data protection, export controls and related technologies
• Communicate risk insights, control requirements and key issues to senior management and stakeholders

Required profile

• Bachelor's degree in Information Security, Computer Science, Computer Engineering or a related discipline
• Relevant information security experience in banking or financial services, preferably wealth management
• Strong interpersonal, communication and organisational skills, able to work independently and under pressure
• Ability to influence stakeholders and resolve conflicts constructively

Required skills

• Information security and risk governance with hands-on experience
• Knowledge of banking regulatory requirements and industry standards, particularly in Singapore and Hong Kong (preferred)
• Professional certification such as CISSP, CISM or CISA, and familiarity with frameworks such as ISO 27001 (advantageous but not required)