Senior Operational Risk Manager - Technology & Information Security

An opportunity for an experienced Operational Risk, Internal Audit, Risk & Controls, or Technology Risk Governance professional to play a key role in the oversight of technology and information security risks within a complex financial services environment.

Working within a second line of defense function, this role focuses on the assessment, challenge and enhancement of risk and control frameworks across technology-related activities. The successful candidate will work closely with stakeholders across risk, technology and business functions to strengthen operational resilience, improve control effectiveness and support enterprise-wide risk management initiatives.

Responsibilities:
- Lead the identification, assessment, monitoring and reporting of operational risks across technology-related functions using an established risk management framework.
- Conduct and review root cause analysis of operational risk incidents, assess remediation plans and challenge the effectiveness of corrective actions.
- Lead Risk and Control Self-Assessments (RCSA) across technology and information security risk domains.
- Provide independent oversight, review and challenge of technology, information security and related control environments from a second line of defense perspective.
- Partner with technology, security and business stakeholders to identify, assess, escalate and mitigate operational risks relating to technology, cybersecurity, third-party services and business continuity.
- Support the implementation and embedding of risk management frameworks across technology-focused functions and promote strong risk and control practices.
- Act as a trusted advisor to first line teams, providing practical guidance on risk identification, control improvement and issue management.
- Analyse significant operational risk events and emerging risk themes, contributing to the ongoing enhancement of the enterprise-wide risk and control framework.

Why You Should Consider This Opportunity:
- Play a visible role overseeing technology and information security risks within a highly regulated environment.
- Work across multiple operational risk domains, including technology risk, cybersecurity risk, third-party risk and business continuity.
- Influence risk and control practices through independent review, challenge and stakeholder engagement.
- Contribute to the continued development and enhancement of a firmwide operational risk framework.
- Work closely with both business and technology stakeholders, providing broad organisational exposure and impact.

Employee Benefits:
Social insurance and statutory benefits in accordance with Japanese law. Additional benefits are available and can be discussed during the recruitment process.

Essential:
- Experience within Operational Risk Management, Internal Audit, Risk & Control, Technology Risk Governance, Risk Assurance, Internal Controls, or a similar oversight function.
- Strong understanding of operational risk management principles, control frameworks and risk assessment methodologies.
- Experience assessing control effectiveness, conducting risk reviews, audit activities, control testing, incident reviews or remediation oversight.
- Exposure to technology, information security, cybersecurity, IT risk, or technology control environments.
- Experience facilitating risk assessments, control reviews, process improvement initiatives or governance activities across multiple stakeholder groups.
- Ability to provide effective challenge and oversight while building strong working relationships with business and technology functions.
- Excellent communication and presentation skills, with the ability to articulate risk and control matters to both technical and non-technical audiences.
- Business-level or fluent Japanese and English language skills.
- Bachelor's degree in Information Technology, Computer Science, Business, Risk Management, or a related discipline.

Preferred:
- Experience within financial services or another highly regulated environment.
- Experience leading or participating in Risk and Control Self-Assessments (RCSA).
- Knowledge of technology risk, information security governance, third-party risk management and business continuity risk.
- Familiarity with recognised frameworks and standards such as NIST Cybersecurity Framework (CSF) and ISO/IEC 27001.
- Relevant professional certifications such as CIA, CISA, CRISC, CISSP, CISM, CEH or equivalent.

Don't meet every requirement?
Feel free to apply, as we also support opportunities beyond those advertised on our website.