VP/AVP, Cybersecurity Governance & Compliance Lead

About the role

Group Technology at DBS manages most of the bank's operational processes and delivers banking services across multiple channels. As VP/AVP, Cybersecurity Governance & Compliance Lead, you will support the delivery and implementation of the bank's cybersecurity risk management and compliance programmes, ensuring its technology and information assets comply with relevant cybersecurity regulations. You will work with key stakeholders to monitor and implement practices aligned with the bank's cybersecurity policies and standards, and help evaluate, address and remediate identified risks.

Key responsibilities

• Support the bank's cybersecurity programme, including policies, regulatory audits, compliance management, metrics, risk and performance indicators, and reporting to senior management
• Track new security regulatory guidelines and assess their impact on the bank's security policy architecture, working with regional information security teams in core markets
• Develop, review and update information security policies and standards to meet regulatory requirements
• Conduct cybersecurity risk assessments and coordinate the Risk and Compliance programme's risk identification and assessment
• Monitor cybersecurity risks, map risk profiles, manage the risk register and enhance Key Risk Indicators for reporting to second-line-of-defense and risk management committees
• Evaluate cybersecurity controls continuously and drive remediation, and engage Line of Business Technology units in annual risk assessments of key systems
• Assist operations teams in implementing corporate operational risk policies, and assess security deviations and risk acceptances raised by business units
• Liaise with auditors and information security services teams on cybersecurity-related audits

Required profile

• Information security professional with five or more years of experience; a background in a financial or technology environment is preferred
• Experience collating, managing and reporting security metrics such as open vulnerabilities, penetration testing findings, security alerts and incidents
• Knowledge of frameworks such as ISO 27000 and regulations including the Cybersecurity Act, Cybersecurity Code of Practice, Technology Risk Management Guidelines and Personal Data Protection Act
• Experience managing Critical Information Infrastructure systems for compliance with the Cybersecurity Act is beneficial
• Good verbal and written communication for producing security awareness content
• Proactive, analytical, performance-oriented and independent, with strong organisation and follow-up skills

Required skills

• Enterprise security risk management methods and techniques
• Security technology solutions: IDS, IPS, anti-virus, content filtering, secure email, network sniffing, log analysis, forensics and VPN