Our client is a large APRA-regulated financial services organisation in the middle of significant technology change. They need a senior technology risk contractor who can start quickly and become the main Line 1 risk partner to their Technology function.

This contract needs someone who has done the job many times before. You’ll work directly with the Technology leadership team and GM-level stakeholders, acting as their main counterpart for Line 2 Risk and Line 3 Internal Audit. Your focus will be helping the leadership team with technology-related regulatory engagements and getting material risk and audit remediation closed out.

The role has no direct reports to begin with. Scope may grow over the course of the contract.

The engagement

• Support the Technology leadership team through APRA and other regulatory engagements, reviews and information requests, including responses, evidence and attestations
• Take hold of remediation for material technology risks, issues and audit findings, and drive it through to evidenced closure, escalating where progress or exposure needs attention
• Act as the senior risk advisor to Technology leaders, applying the Risk Management Framework, risk appetite and regulatory obligations in a practical way that keeps delivery moving
• Prepare clear, executive-quality risk papers and committee reporting for senior management and risk forums
• Keep Technology’s risk profile accurate and defensible: key and emerging risks, risk appetite measures, tolerances, KRIs and treatment plans
• Provide risk input to major technology change, covering delivery risk and the risk in what is delivered, across the full project lifecycle
• Strengthen the control environment through control design and mapping, self-assessments, root cause analysis and evidence of closure
• Bring risk discipline to third-party and material service provider arrangements, including due diligence, resilience, business continuity and ongoing monitoring
• Assess the impact of regulatory change on Technology across information security, operational resilience, outsourcing and business continuity

What you’ll need

• Essential: significant technology risk experience in a bank or superannuation fund, ideally across several engagements
• Essential: hands-on experience with APRA prudential standards, particularly CPS 234, CPS 230 and related guidance on information security, operational resilience, service provider management and business continuity
• A record of getting up to speed fast in a new organisation and delivering from the first week
• Credibility with GM-level executives and confidence engaging with Line 2, Line 3 and regulators
• Experience driving complex risk and audit remediation to closure under scrutiny
• A solid understanding of technology risk across infrastructure, cyber, data, cloud, change and third parties
• Excellent written communication, with the ability to produce decision-ready papers
• Desirable: certifications such as CRISC, CISA, CISM, CGEIT, COBIT, ITIL or ISO 27001
• Desirable: experience with GRC platforms, control libraries and obligation registers
•