Technology Risk & Resilience Manager (Second Line)

About the role

MUFG Investor Services is looking for an experienced Technology Risk & Resilience Manager to join its second line risk function in London or Dublin. The role provides independent second line oversight and credible challenge of technology risk (IT and information security), integrating it into the firm's second line Risk Management Framework and supporting DORA, third-party risk and service resilience expectations. It does not own or operate technology risk controls.

Key responsibilities

• Embed technology risk in the Operational Risk Taxonomy and Framework, defining 1LOD vs 2LOD accountability
• Oversight of the Technology Risk Management Framework and its alignment with first-line controls (third-party risk, IT controls, cybersecurity)
• Challenge first-line identification and assessment of application, infrastructure, information security and third-party technology risks, and the quality of risk registers and control inventories
• Integrate technology risk into operational resilience, including dependency mapping, incident assessment and reporting
• Oversight of technology-related third-party risks and dependency/concentration risk with critical vendors
• Oversight of technology-related change activities, including IT BAU change, business change and changes to critical services
• Thematic reviews of incidents, audit findings and control weaknesses
• Draft and peer review committee papers, deliver the annual DORA attestation and report technology risk themes to management and risk committees
• Support the Head of Risk in setting and challenging technology risk appetite, and engage with senior first-line leaders and control functions

Required profile

• Post-secondary degree in technology, business or a related discipline, plus CRISC, CISSP or CISM
• 10+ years in a second line or independent risk oversight role covering technology, IT or cyber risk in a financial institution or compatible industry
• Experience in fund services, asset servicing or regulated financial services, and in governance of IT architecture, application and EUC development
• Ability to face challenges from CISO/CIO/CTO level and collaborate across Risk, Enterprise, Data, Operational Risk & Resilience
• Fluency with NIST CSF, ISO 27001/27002 and COBIT; exposure to multi-entity, cross-jurisdictional regulation (e.g. Ireland / Cayman)

Required skills

• Experience with DORA, operational resilience or similar regulatory regimes
• Advanced Excel; Microsoft Office, SharePoint and Microsoft 365; Power BI, Tableau and Power Apps preferred