SVP, Information & Technology Risk (Infrastructure, Security & Resilience Risk Oversight)

Location:Singapore

Job Type:Permanent

Req ID:17406

GIC is one of the worlds largest sovereign wealth funds. With over 2000 employees across 11 locations around the world we invest in more than 40 countries globally across asset classes and businesses. Working at GIC gives you exposure to an extraordinary network of the worlds industry leaders. As a leading global long-term investor we Work at the Point of Impact for Singapores financial future and the communities we invest in worldwide.

Risk and Performance Management Department (RPMD)
We work collaboratively across teams to help guard against blind spots and ensure that all relevant risks are considered and duly addressed.

Information & Technology Risk Management

You will be a part of a team that independently protects the firms information technology assets including business data from external threats and operational risks while supporting the firms digitalisation journey in a secure manner.

What will you do as an SVP Information & Technology Risk (Infrastructure Security & Resilience Risk Oversight)

As a Senior Vice President Information & Technology Risk (Infrastructure Security & Resilience Risk Oversight) in GIC you will operate as part of the Second Line of Defence (2LOD) leading independent oversight assurance and challenge over technology and cyber risk management activities across GIC. The role reports to the Head of Second Line of Defence / Information & Technology Risk Management within the Chief Risk Officer organisation.

You will bring deep expertise in infrastructure cloud cybersecurity and operational resilience risk. The role ensures that technology infrastructure security and resilience risks are effectively identified assessed and managed in alignment with GICs risk appetite regulatory expectations and industry best practices.

Key Responsibilities

Infrastructure & Cloud Risk Oversight

• Provide independent oversight of risk management practices across the technology infrastructure estate including data centres compute storage networks and end-user computing.
• Review and challenge the design and operating effectiveness of controls over hybrid and multi-cloud platforms including configuration management workload isolation and cloud entitlement management.
• Assess infrastructure hygiene controls patching hardening asset and configuration management capacity and technology currency and challenge remediation of control gaps.
• Evaluate risks arising from infrastructure change platform migrations and automation ensuring appropriate governance and rollback controls.

Cybersecurity Risk Oversight

• Provide independent oversight and challenge of the cybersecurity control environment including identity and access management privileged access threat detection and security operations (SOC).
• Review and challenge vulnerability and threat management practices including penetration testing and remediation of critical exposures within agreed risk tolerances.
• Assess the adequacy of security monitoring logging and incident detection capabilities against GICs threat profile.
• Advise on emerging cyber risks including ransomware supply-chain compromise and AI-enabled threats and challenge the sufficiency of mitigating controls.

Technology & Operational Resilience Oversight

• Provide independent oversight of technology and operational resilience arrangements including availability management disaster recovery backup integrity and cyber recovery capability.
• Review and challenge the identification of critical business services impact tolerances and mapping of supporting technology dependencies.
• Assess the scope rigour and outcomes of resilience and recovery testing including scenario and severe-but-plausible testing and challenge remediation of identified weaknesses.

Third-Party Technology Risk Oversight

• Provide independent oversight of technology and cyber risk arising from third parties including cloud service providers managed service providers and material outsourcing arrangements.
• Review and challenge third-party due diligence contractual control requirements ongoing monitoring and exit and substitutability planning.
• Assess compliance with regulatory expectations on outsourcing and third-party risk management including cross-border and sub-contracting considerations.
• Challenge the adequacy of controls over third-party access data handling and interconnectivity with GIC environments.

Independent Oversight Assurance & Incident Response

• Conduct thematic and targeted reviews to assess the adequacy and effectiveness of infrastructure security and resilience controls and provide independent challenge to First Line of Defence (1LOD) risk assessments control testing and remediation plans.
• Act as the independent challenge function over Operational Risk Self Assessments (ORSAs) performed by the First Line of Defence (1LOD) challenging the completeness of risk and control identification the rigour of control effectiveness ratings residual risk conclusions and the adequacy and timeliness of resulting remediation actions.
• Report key risk exposures control weaknesses and emerging issues to senior management and governance committees including risk appetite and key risk indicator reporting.
• Provide independent oversight of significant cyber infrastructure and availability incidents ensuring proper escalation root cause analysis and remediation follow-through.
• Provide independent oversight and reporting over all Infrastructure Cloud and Security Operational Risk Events (OREs) including timely identification and escalation validation of root cause and impact assessment thematic and trend analysis and reporting of event and remediation status to senior management and relevant risk committees.
• Partner with Internal Audit and other assurance functions to ensure comprehensive and non-duplicative coverage of technology risk areas.

Stakeholder Engagement

• Contribute to the enhancement of GICs technology risk frameworks policies standards and risk appetite measures.
• Build effective relationships with Technology Information Security Operations Compliance and business stakeholders and promote a strong risk culture across the organisation.

What qualifications or skills should you possess in this role

• Minimally 1215 years of experience in technology risk management information security assurance or audit management preferably within financial institutions or regulated environments including experience leading teams.
• Deep expertise across infrastructure cloud and cybersecurity risk with practical understanding of operational and technology resilience and third-party technology risk.
• Proven experience assessing and challenging infrastructure and security controls identity and privileged access vulnerability and threat management configuration and patch management backup and recovery.
• Strong familiarity with technology risk and control frameworks (e.g. MAS TRM MAS Outsourcing and Business Continuity guidelines ISO 27001 NIST CSF CIS COBIT).
• Strong understanding of regulatory expectations relating to cyber resilience operational resilience outsourcing and technology risk management.
• Excellent analytical communication and stakeholder management skills with the ability to influence senior management and technical teams and to articulate risk in business terms.
• Relevant certifications advantageous (e.g. CISSP CISM CRISC CISA cloud security certifications).
• Commitment to continuous learning and staying current with the evolving infrastructure cyber resilience and AI risk landscape.

Work at the Point of Impact
We need to be forward-looking to attract the right people to help us become the Leading Global Long-term Investor. Join our ambitious agile and diverse teams - be empowered to push boundaries and pursue innovative ideas share your views and be anchored on our PRIME Values: Prudence Respect Integrity Merit and Excellence which guides us in how we make our day-to-day decisions. We strive to inspire. To make an impact.

Flexibility at GIC
At GIC our offices are vibrant hubs for ideation professional growth and interpersonal connection. At the same time we believe that flexibility allows us to do our best work and be our best selves. Thus our teams come into the office four days per week to harness the benefits of in-person collaboration but have the flexibility to choose which days they work from home and adjust this arrangement as situational needs arise.

GIC is an equal opportunity employer
As an employer we passionately believe every individual brings with them unique diversity of thought and perspectives to meaningfully enrich perspectives of GIC teams to drive competitive performance. An inclusive environment yields exceptional contribution.

Learn more about our Risk & Performance Management Department here:

Experience:

Senior Exec