Director, OTCR, CIB

Job Summary

The purpose of this role is to act as the primary point of contact within the Second Line Operational, Technology and Cyber Risk (OTCR) function for the Corporate and Investment Banking business (the Business), covering all non financial risk matters across operational processes, technology platforms, information security and cyber resilience.

The role provides independent oversight, challenge and assurance to ensure that the Business identifies, assesses, manages and escalates Operational, Technology and Cyber risks in line with the Group’s Enterprise Risk Management Framework (ERMF) and the OTCR Risk Type Framework, and that material risks and control weaknesses are transparently governed.

Key Responsibilities

This role includes responsibility for monitoring, reviewing and challenging the Business’s adherence to its obligations under the Operational, Technology and Cyber Risk frameworks, ensuring that:

• Material risks across operations, systems, technology resilience, cyber security and data are appropriately identified and assessed;

• Controls are designed, implemented and operating effectively; and

• Breaches, incidents and weaknesses are escalated in line with appetite, policy and governance requirements.

This is delivered through close collaboration with other Second Line risk teams, including Technology Risk, Information & Cyber Security (ICS), Third Party Risk and relevant Centres of Excellence, as well as enterprise wide SMEs.

The role holder is expected to demonstrate deep subject matter expertise in one or more OTCR domains, including:

• Operational and process risk within Corporate and Investment Banking;

• Technology risk, system stability, resilience and change delivery;

• Information and Cyber Security risk, including data protection and control frameworks.

• The role holder must understand the interdependencies between operational processes, technology platforms and cyber vulnerabilities, and how weaknesses in one domain can amplify risk in another.

• Coverage includes all Second Line responsibilities within the Group’s Enterprise Risk Management Framework (‘ERMF’). This includes oversight, review and challenge of all risk decision making within the Business.

From a regulatory perspective, the role requires a strong understanding of global supervisory expectations relating to operational resilience, technology risk and cyber security, including banks’ obligations to demonstrate robust identification, monitoring and control of risks arising from end to end processes, critical systems and digital infrastructure

• The role holder is expected to understand how these requirements are embedded within the OTCR Risk Type Framework, and how they interact with other Risk Type Frameworks under the ERMF.

• The Second Line OTCR function is responsible for independent oversight and challenge, ensuring that risks are appropriately identified, assessed, controlled and managed within risk appetite, and that material issues are escalated, tracked and remediated. The role holder is accountable for leading the delivery of Second Line OTCR responsibilities for the CIB business, including continuous improvement of risk transparency, control effectiveness and governance outcomes.

Business

• Demonstrate deep understanding of the Business strategic priorities to effectively advise and challenge decisions across all relevant Risk Types. Demonstrated experience/SME in an equivalent 1st line/2nd line role managing one or more areas of the Business particularly Operations is a strong plus.

• Review and recommend resolutions to risk-related escalations from the Business, keeping in mind Operational, Technology and Cyber Risk Appetite thresholds, policies, and procedures.

• Work with OTCR Policy team to clarify / interpret any policy-related matters or queries from the Business.

• Identify internal / external insights and emerging risks that can impact the Business.

• Attend relevant Business Risk committees representing Risk in advising, challenging and providing Risk insights to business stakeholders.

The role-holder is also responsible for taking a lead in ensuring that the Business adheres to agreed Operational, Technology and Cyber Risk Appetite, including supporting the Business in defining its Operational, Technology and Cyber Risk strategy in conjunction with Group Internal Audit. This includes the challenging of the Business strategy and Corporate Plan and seeking to embed awareness and engagement with all Operational, Technology and Cyber Risk sub-types across the Business.

This will be achieved through partnership, challenge and control as follows:

• Partnership: Offering general advice on all PRTs and Operational, Technology and Cyber Risk sub-types to key stakeholders.

• Challenge: Reviewing and challenging the Business’s articulation and calibration of Operational, Technology and Cyber Risk – identification of risks and potential points of failure, control design and implementation and continual review of both gross and residual risk assessments.

• Control: Drive and foster adoption of – and monitor adherence to - the Operational, Technology and Cyber Risk Type Framework - and related Policy and Standards - by the Business, including adherence to clearly defined roles for each of the three lines of defence, supported by appropriately designed training and other awareness/engagement-focused routines.

Processes

• Take ownership of all Second Line OTCR accountabilities within the ERMF, as they pertain to the Business, including active participation in OTCR governance forums, risk reviews, control assessments and thematic deep dives.

• Act as a visible advocate for integrated OTCR risk management, promoting consistency, clarity and practical risk ownership across all three domains.

Risk Management

• Ensure all activity adheres to the Risk Management Framework, with a specific focus on ensuring an effective framework for the management of Operational, Technology and Cyber risks, within the team as they pertain to the role.

Governance

• Demonstrate an awareness and understanding of the regulatory framework in which the Group operates, and the regulatory requirements and expectations relevant to the role.

• Deliver ‘effective governance’; capability to challenge colleagues effectively; and willingness to work in an open and collaborative mindset.

Regulatory & Business Conduct

• Display exemplary conduct and live by the Group’s Values and Code of Conduct.

• Take personal responsibility for embedding the highest standards of ethics, including regulatory and business conduct, across Standard Chartered Bank. This includes understanding and ensuring compliance with, in letter and spirit, all applicable laws, regulations, guidelines and the Group Code of Conduct.

• Support the CIB Operational, Technology and Cyber Risk function to achieve the outcomes set out in the Bank’s Conduct Principles.

• Effectively and collaboratively identify, escalate, mitigate and resolve risk, conduct and compliance matters.

Key stakeholders

Internal:

• Chief Operating Officers – CIB & supporting teams

• Internal Audit

• Risk Framework Owners

• Subject Matter Experts (as defined by the Operational, Technology and Cyber Risk Type Framework)

• Members of the Group OTCR Team and Country OTCR teams

External:

• NIL

Other Responsibilities

• Embed Here for good and Group’s brand and values in Group Operational, Technology and Cyber Risk Team.

• Perform other responsibilities assigned under Group, Country, Business or Functional policies and procedures.

Motivations

• Energised by analysing complex risk and control information to identify emerging threats, systemic weaknesses and opportunities for sustainable risk reduction.

• Driven by improving the effectiveness of material controls and ensuring that risk assessments, remediation plans and management decisions are supported by clear evidence and sound judgement.

• Thrives in a fast-paced and evolving risk environment that requires critical thinking, commercial awareness and confident decision-making across technology, cyber, resilience and third-party risk.

• Motivated by supporting major business and technology transformation programmes while ensuring that delivery risks, dependencies and potential customer or regulatory impacts are identified and addressed early.

• Energised by using data, automation and emerging technologies, including AI, to enhance risk insights, simplify oversight activities and improve the quality and timeliness of risk management.

• Driven by collaborating with First Line teams, Risk Framework Owners and senior stakeholders to achieve practical, proportionate and sustainable risk outcomes.

• Motivated by developing risk capability, sharing knowledge and fostering a culture of accountability, proactive risk identification and continuous improvement across the team.

Our Ideal Candidate

10+ years of experience in Technology and Cyber Risk management within the Banking industry, including relevant regulation and industry trends. In particular, the role holder will demonstrate:

• A rigorous and analytical approach to risk management, with strong attention to detail, control effectiveness and due diligence

• Experience in enhancing frameworks and policies

• Experience of business partnering, with the ability to simply and clearly communicate complex technical and risk topics to diverse audiences

• Experience in assurance or audit is an advantage

• Ability to manage and influence a diverse and challenging stakeholder community / team

• Proven ability to coordinate multiple dependencies in a complex, large-scale environment

• Excellent oral, written communication and presentation skills

• Specific strong competence in the use of Excel for analysis of complex data and PowerPoint for effective communication

• Experience in Algo Trading and/or Digital Assets is an advantage

• Relevant Professional Certifications, such as CISSP, CRISC, CISA, CISM, CCSP, ITIL, AAIR/AAISM, are an advantage.

Ideally the role holder will have hands-on experience with Operational, Technology and Cyber Risk frameworks, together with in-depth knowledge of some of the key organisational and operational challenges faced by a Second-Line Operational, Technology and Cyber Risk function

Role Specific Technical Competencies :

• Relevant Professional Certifications (e.g. CISSP, CRISC, CISA, CISM, CCSP, ITIL, AAIR/AAISM) an advantage

About Standard Chartered

We're an international bank, nimble enough to act, big enough for impact. For more than 170 years, we've worked to make a positive difference for our clients, communities, and each other. We question the status quo, love a challenge and enjoy finding new opportunities to grow and do better than before. If you're looking for a career with purpose and you want to work for a bank making a difference, we want to hear from you. You can count on us to celebrate your unique talents and we can't wait to see the talents you can bring us.

Our purpose, to drive commerce and prosperity through our unique diversity, together with our brand promise, to be here for good are achieved by how we each live our valued behaviours. When you work with us, you'll see how we value difference and advocate inclusion.

Together we:

• Do the right thing and are assertive, challenge one another, and live with integrity, while putting the client at the heart of what we do

• Never settle , continuously striving to improve and innovate, keeping things simple and learning from doing well, and not so well

• Are better together , we can be ourselves, be inclusive, see more good in others, and work collectively to build for the long term

What we offer

In line with our Fair Pay Charter , we offer a competitive salary and benefits to support your mental, physical, financial and social wellbeing.

• Core bank funding for retirement savings, medical and life insurance , with flexible and voluntary benefits available in some locations.

• Time-off including annual leave, parental/maternity (20 weeks), sabbatical (12 months maximum) and volunteering leave (3 days), along with minimum global standards for annual and public holiday, which is combined to 30 days minimum.

• Flexible working options based around home and office locations, with flexible working patterns.

• Proactive wellbeing support through Unmind, a market-leading digital wellbeing platform, development courses for resilience and other human skills, global Employee Assistance Programme, sick leave, mental health first-aiders and all sorts of self-help toolkits

• A continuous learning culture to support your growth, with opportunities to reskill and upskill and access to physical, virtual and digital learning.

• Being part of an inclusive and values driven organisation , one that embraces and celebrates our unique diversity, across our teams, business functions and geographies - everyone feels respected and can realise their full potential.

Recruitment Assessments

Some of our roles use assessments to help us understand how suitable you are for the role you've applied to. If you are invited to take an assessment, this is great news. It means your application has progressed to an important stage of our recruitment process.

Visit our careers website