Cyber and Technology Risk Officer

About the role

The Cyber and Technology Risk Officer is part of the First Line of Defense, supporting day‑to‑day management of cyber and technology risk within the Enterprise Risk Management Framework. The role works closely with the Resilience Risk Manager and Head of Resilience to embed effective risk practices across business units.

Key responsibilities

• Support the integration of technology, information security and cyber risk activities in line with ERMF and ORRMF policies.
• Ensure risks are identified, assessed, recorded and monitored in risk registers, control inventories and issue logs.
• Maintain accurate risk data, including controls, issues and key risk indicators, to guarantee reporting integrity.
• Drive risk and control self‑assessments for material technology or cyber risks, ensuring consistent and high‑quality outputs.
• Review design and operating effectiveness of controls across access management, change management, cyber controls, resilience controls and third‑party technology risk.
• Identify control gaps, define remediation actions with owners, set realistic timelines and track progress to closure.
• Escalate delays, control failures or out‑of‑tolerance risks to the Resilience Risk Manager or Head of Resilience.
• Analyse recurring weaknesses, emerging risks and thematic trends from incidents, conformance reviews and audit outcomes, and feed them into risk management practices.
• Prepare clear, timely and decision‑useful risk reports for senior stakeholders.

Required profile

• Relevant experience in technology risk, cyber risk and information security.
• Understanding of enterprise risk management and resilience frameworks.
• Ability to work within the First Line of Defense and collaborate with risk managers.
• Strong analytical and communication skills to document and report risk information.

Required skills