Job information:

• Functional title – Director, Information Security Risk and Control
• Department – Chief Controls Office
• Corporate level - Director
• Report to – Executive Director, Technology Risk and Control
• Location – London

What you will be doing:

This is an exciting opportunity for a talented individual to join our newly formed Chief Controls office (CCO), a dedicated first line risk and control function.  This role has arisen due to the expansion of responsibilities, offering the successful candidate the opportunity to make an impact and actively contribute to the evolution of this new group.

As part of the CCO team, you will play a key role :

• Improving the oversight of non-financial risks, bringing risk and control subject matter expertise to partner with 1LOD business owners to proactively identify, assess and mitigate risks.
• Providing cross functional oversight across the first line, driving best practices and consistency in control standards for the effective control of risks to within risk appetite.
• Driving behaviors to foster a risk-aware and risk intelligent culture where employees recognize their role as risk managers and the importance of the control framework.

What we’re looking for:

The role is a Director level at CLS which is equivalent to a Director or Senior Vice President in some banks.  The role would suit candidates with 2LOD/3LOD experience looking for an opportunity to move into 1LOD, or candidates with 1LOD control/ control remediation/ validation experience.

The Information Security Risk and Control Director is a key member of the CCO team who will work closely with the Technology division and other Information Security stakeholders in the management of risk and controls. This includes but not limited to:

• Develop and implement a consistent, effective and efficient approach to the control of risks.
• Identify and deliver best practices in control standards across CLS.
• Lead Security’s engagement with Audit, also key liaison with 2LOD Risk and Compliance.
• Support the identification, assessment of risks and controls.
• Review remediation plans from a risk/control lens to ensure risks are sufficiently addressed, consider design/operating effectiveness, strategic/tactical solutions etc.
• Monitor and report on corrective actions.
• Contribute to risk appetite statements and emerging risks.
• Review KRIs to ensure meaningful metrics for management oversight, review/challenge breaches to understand root causes, consult on lessons learned exercises and work with business owners to develop a ‘path to green’ where appropriate.
• Consolidate and report on the results of risk and control activity to internal stakeholders, escalating as required.
• Represent CCO in working groups or Committees as required. Must be an effective communicator, able to understand the detail but adapt the messaging to align with the audience/seniority of the forum including internal Committees, Board presentations and/or Regulatory communications.
• Lead adhoc cross-Technology control initiatives where appropriate.
• Build strong relationships with peers to enable cross functional oversight and develop and implement best practices.
• Supervise junior members of the team, including coaching and training, driving consistency and ‘added value’.
• Establish positive working relationships with senior stakeholders across the business. Experience of managing Internal Audit engagement, control remediation and audit validation either from a 1LOD ownership perspective or 2LOD/3LOD validation.
• Knowledge of Information Security delivery within Financial Services, and ability to demonstrate an understanding of key challenges and risks which must be mitigated and managed to enable successful delivery.
• Proven experience in one of the following:
  • 1LOD control remediation
  • Information Security Risk Management
  • Compliance
  • Internal Audit
• Knowledge of Financial Services, Financial Markets Utilities or another highly regulated industry sector is essential.
• Experience engaging with regulators, both in person and in the preparation of documentation.

Competencies required for successful job performance:

• Demonstrate strategic mindset, link individual activities to the wider landscape to see the big picture.
• Challenge the status quo, be a catalyst for change, driving and cultivating innovative thinking to solve complex problems. Ability to ‘speak up’, break down barriers and provide constructive challenge.
• Attention to detail is essential, demonstrate high standards to control and oversight of risk.
• Take professional pride in making a difference, being proactive and delivering best in class solutions, creating long term value by addressing root cause issues.
• Build effective working relationships with multiple internal and external stakeholders, negotiating effectively to bring different viewpoints together as appropriate.
• Manage ambiguity, operating effectively and decisively to navigate a path forward.
• Excellent verbal and written communication skills with ability to adapt to the audience (junior/senior, internal/external) to be effective and meaningful, breaking down complex problems in an easy-to-understand manner.

Professional qualifications / certifications

• Qualifications in any of the following specialisms would be beneficial but not essential:
  • Risk Management
  • Internal Audit
  • Compliance
  • Project Management
  • Information Security
  • Technology process governance
• Highly proficient IT skills in Word, Excel, PowerPoint and PDF.

#LI-JW1