POSITION SUMMARY:
As a member of the Cyber & Technology Risk Management team, the Senior Manager - Technology Risk Management reports to the Assistant Vice President - Technology Risk Management and supports the AVP and VP of CTRM in the management and oversight of technology risk across GEG.

The role provides independent technology risk assessment and advisory support across the project lifecycle, working with IS&T and business stakeholders to identify and manage technology and cyber risks, promote Security by Design, and support emerging areas including AI security, third-party AI services and regulatory assessments.

PRIMARY RESPONSIBILITIES:
- Lead technology risk assessments for new solutions, applications, major changes and emerging technologies throughout the project lifecycle, from concept and architecture through implementation, go-live and post-implementation review.
- Independently evaluate solution designs, data flows, integrations, infrastructure, cloud services, APIs, open-source components and operational arrangements to identify inherent and residual technology and cyber risks.
- Coordinate cross-functional assessments with Enterprise Architecture, Cyber Security, Infrastructure, Application, Data, Cloud, Operations and other IS&T teams, ensuring risks, owners, required controls and decisions are clearly documented and followed through.
- Provide practical Security by Design advice and facilitate discussions with project leaders, architects, Cyber Security and management to agree proportionate controls across identity and access management, data protection, logging and monitoring, vulnerability management, secure development, resilience and third-party connectivity.
- Lead AI security and technology risk assessments for internally developed AI solutions, embedded AI capabilities and third-party AI services, covering data exposure, model and application security, access control, prompt injection, unsafe output, supply-chain, privacy, governance, monitoring and human oversight risks.
- Work with Cyber Security and relevant control owners to interpret security testing results, vulnerabilities, incidents and control gaps; assess business impact and residual risk; and present practical remediation options and recommendations to leaders and management.
- Maintain and improve the Technology Risk Management framework, assessment methodology, standards, templates, risk criteria and governance checkpoints in alignment with regulatory requirements, industry standards and GEG risk appetite.
- Support the management of technology risks across IS&T by maintaining risk records, monitoring remediation and exceptions, identifying common or systemic issues, and escalating material or overdue risks to the appropriate governance forums.
- Prepare and deliver clear assessment reports, risk opinions, dashboards, management papers and presentations, communicating technology and cyber risk implications and recommendations clearly to senior leaders, management and governance forums.
- Provide independent analysis, risk insights and advice to the AVP and VP of CTRM, supporting management discussions, risk-based decisions, governance forums and ad hoc Cyber Security and Technology Risk Management initiatives.

REQUIREMENTS:
- Bachelor’s degree in Computer Science, Cybersecurity, Information Systems, Technology, Risk Management or a related discipline.
- Minimum 10 years of relevant experience in technology risk management, cyber security risk, technology audit, risk advisory, management consulting or related areas, with good experience in technology risk assessment and stakeholder engagement.
- Good understanding of applications, solution designs and technology environments, with the ability to assess new technology initiatives and identify associated technology and cyber security risks.
- Good understanding of Security by Design and key technology and cyber security controls, with the ability to recommend practical and proportionate risk mitigation measures.
- Strong analytical and problem-solving skills, with the ability to assess complex issues, exercise independent judgement and provide practical risk recommendations.
- Strong executive communication, presentation and stakeholder management skills, with the ability to work effectively with IS&T and business leaders, facilitate discussions, manage differing views and communicate technology and cyber risk clearly to senior leadership and relevant stakeholders.
- Excellent planning and organizational skills, with the ability to manage complex, multi-stakeholder initiatives. Strong interpersonal skills, including teamwork, facilitation and negotiation.
- Experience in AI/ML, generative AI, third-party AI services or other emerging technologies, experience with the Macau Cybersecurity Law and related regulatory assessments, and familiarity with relevant technology risk, cyber security or AI risk frameworks would be an advantage.
- Professional certifications such as CISSP, CISM, CRISC, CISA, CCSP or relevant AI governance/security certifications would be an advantage. Excellent written and verbal communication skills in English. Proficiency in Cantonese and/or Mandarin, including writing capability, is an advantage.