Regional Risk Manager - TRM And Cyber GRC

This role sits across both the EMEA Technology Risk Management group and the EMEA Cyber Governance, Risk and Control group. It is a first line regional role responsible for broad technology and cyber risk and control activity across the Middle East, while contributing to the wider EMEA operating model.

The role supports the identification, assessment, ownership, treatment and monitoring of technology and cyber risks. It also supports the design, implementation, operation, testing, evidence and remediation of controls. Reporting and management information are important enabling activities, but they are not the primary focus of the role.

The post holder will work as part of the established regional team and in close partnership with existing Technology Risk Management, Cyber GRC, Information Security and Technology colleagues. The role is intended to complement existing individuals in the region by adding capacity, coordination and specialist risk and control capability. It does not create parallel ownership or replace established accountabilities. The role reports locally to the Head of IT for the Middle East and maintains functional alignment with both the EMEA Technology Risk Management and EMEA Cyber GRC teams in London.

• Operates within the first line Technology and Cyber organisation, reporting locally to the Head of IT for Dubai, with functional alignment to the EMEA Technology Risk Management and EMEA Cyber GRC teams in London.
• Provides a clear Middle East regional presence from Dubai and connects regional requirements, risks and control matters into the wider EMEA framework.
• Supports a strong, consistent and transparent technology and cyber risk and control environment aligned to internal frameworks, risk appetite and applicable regulatory expectations.
• Works with regional and global stakeholders to improve consistency while preserving local ownership, expertise and decision rights.

Unless specifically stated otherwise, each responsibility below applies across both technology and cyber risk, controls, governance and assurance.

• Support the identification, assessment, ownership, treatment, acceptance, monitoring and evidence based closure of technology and cyber risks and issues across EMEA.
• Maintain an integrated, decision ready view of material risks, control gaps, issues, exceptions, actions, decisions, milestones, dependencies and remediation activity, linked to business impact, risk appetite and regulatory expectations.
• Embed practical risk management within day to day Technology and Cyber activities, programmes, projects, services and material change initiatives.
• Ensure risks and issues are clearly articulated, consistently assessed, linked to relevant work and assigned to accountable owners.
• Provide constructive first line challenge on risk assessments, treatment plans, evidence and closure proposals without assuming ownership held by service or control owners.

• Support the design, implementation, operation, testing, evidencing, validation and improvement of proportionate technology and cyber controls.
• Help define clear control objectives, ownership, frequency, evidence requirements, performance measures, quality gates and escalation triggers.
• Identify recurring weaknesses and thematic issues, and support sustainable improvements to control design, operation and evidence quality.
• Help owners address overdue or Red and Amber items through practical recovery plans with clear owners, dates, blockers, escalation routes and closure criteria.

• Coordinate first line responses to regulatory requirements, including DORA, EBA guidance, relevant Middle East expectations and entity or Head Office requests.
• Translate regulatory requirements into practical controls, processes, evidence and accountable actions.
• Maintain a controlled record of commitments, owners, inputs, dates, evidence, blockers, dependencies and escalation status.
• Maintain traceability between obligations, policies, standards, controls, risks, evidence, findings and remediation.
• Coordinate input from subject matter experts and control owners so submissions are accurate, complete, consistent, reviewed and evidence based while preserving their accountability.

• Support policy owners with the review, update, approval and governance of technology and cyber policies and standards, maintaining alignment with regulation, internal frameworks and control obligations.
• Coordinate owners, reviewers and approvers through the policy lifecycle and annual approval cycle.
• Manage policy exceptions through documented justification, risk assessment, compensating controls, approval and review dates.
• Support technology and cyber policy improvement activity, including ECB related requirements, cyber skills framework operationalisation and associated process governance.

• Coordinate the monthly technology and cyber metrics cycle with accountable data and metric owners.
• Help owners define and review KRIs, KCIs and KPIs, including thresholds, data sources, ownership and data quality controls.
• Coordinate action where performance is outside tolerance or evidence is incomplete.
• Provide clear analysis of trends, service health, control effectiveness, risks, issues, remediation progress and regulatory commitments.
• Support controlled automation of reporting processes using approved tooling, with clear ownership, testing, auditability and traceability.

• Support and coordinate technology and cyber reporting for the Security and Technology Risk Committee and provide reviewed Technology Risk Management and Cyber GRC input to other executive, entity and Head Office forums.
• Prepare concise, accurate papers covering material risks, controls, actions, service health and decisions.
• Maintain consistency and traceability across submissions while respecting forum ownership and approval routes.
• Coordinate contributors to meet deadlines, resolve data or evidence gaps and maintain clear records of decisions and actions.