IT Risk Management manager - NGERN HAI JAI CO., LTD.

Strategy & Leadership  

• Lead the IT risk function, building strong governance structures and capabilities 

• Define and implement the enterprise IT risk management strategy aligned with overall risk appetite and business objectives  

• Provide expert advice to executive management and committees (e.g., Management Committee and Board of Directors) on IT risk exposure and mitigation strategies  

• Foster a strong risk-aware culture across technology and business teams  

IT Risk Framework & Governance  

• Establish and maintain IT risk policies, standards, and procedures in line with BOT guidelines (e.g., IT Risk Management, Cybersecurity, Outsourcing regulations)  

• Provide IT Risk Advisory Service on IT projects in a manner to address the current risks and supervise the proper controls to mitigate risk by complying with regulations and laws. Also, preparation reporting to Management Committee and Board of Directors 

• Develop processes for risk identification, assessment, measurement, monitoring, and reporting 

• Ensure full integration of IT risk management within enterprise risk management (ERM) framework 

Regulatory Compliance  

• Ensure compliance with BOT regulatory requirements, including IT Risk Management Framework, Cybersecurity guidelines, outsourcing regulations and regulatory submissions related to technology risk  

• Monitor regulatory developments and ensure timely implementation  

Cybersecurity & Technology Risk Oversight  

• Provide second line oversight over Cybersecurity risks, Cloud computing, IT infrastructure and Data protection  

• Challenge the effectiveness of IT security controls implemented by first line  

• Oversee risks related to cybersecurity, infrastructure, cloud computing and systems resilience  

Third-Party & IT Outsourcing Risk Management  

• Ensure the IT Third-party Risk Management program aligns with internal policy, and BOT regulatory requirements 

• Oversee IT vendor and IT outsourcing risk management in line with BOT Third-Party guidelines  

• Ensure robust due diligence, risk assessments, and ongoing monitoring of vendors  

• Assess cloud risk and ensure compliance with regulatory expectations  

IT Risk Monitoring & Reporting  

• Define and track Key Risk Indicators (KRIs) for technology risk  

• Conduct risk assessments (RCSA – Risk and Control Self-Assessments) and process reviews regularly 

• Produce high-quality risk reports for  Senior Management, Management Committee and Board of Directors  

• Escalate critical IT risk issues in a timely and transparent manner  

Incident Management & Operational Resilience  

• Oversee IT risk elements of Cyber incident response, Crisis management, Business Continuity Planning (BCP) and Disaster Recovery (DR)  

• Ensure major incidents are investigated and root causes addressed   

Audit & Assurance  

• Coordinate with Internal Audit and external auditors for IT risk and control reviews  

• Ensure prompt closure of audit findings and regulatory issues  

• Conduct independent second line reviews of IT controls and risk assessments  

Qualifications & Experience  

• Bachelor’s or Master’s degrees in IT, Cybersecurity, Risk Management, or related discipline  

• 10+ years of experience in IT risk, cybersecurity, IT governance, or technology audit within banking or financial services  

• Minimum 5 years in a leadership or senior management role  

• Strong understanding of Bank of Thailand regulatory environment  

Skills & Competencies  

• Deep knowledge of banking technology risks and regulatory expectations  

• Strong leadership and stakeholder engagement skills  

• Ability to challenge and influence senior IT and business leaders (second line of defense mindset)  

• Excellent analytical, problem-solving, and decision-making capability  

• Strong communication skills (Thai and English preferred)  

• High integrity and risk governance mindset