Head of CSAT Transformation, Risk and Assurance

If you’re looking for further opportunities to develop your career, take the next step in fulfilling your potential right here at HSBC.
HSBC is one of the largest banking and financial services organizations in the world, with operations in 58 countries and territories. We aim to be where the growth is, enabling businesses to thrive and economies to prosper, and, ultimately, helping people to fulfil their hopes and realize their ambitions.
We are currently seeking an experienced professional to join our team in the role of Cyber Security Assessment and Testing Head of CSAT Risk, Governance and Assurance .
The Opportunity
Global Cybersecurity is responsible for enabling businesses and functions to manage their information, technology and cybersecurity risks by ensuring these are well-understood, and that controls used the manage such events are defined, assessed and implemented appropriately. Cybersecurity delivers this via objective, independent, professional and specialized subject matter experts. The role forms part of the 1LoD in relation to risk management framework.
The Cybersecurity Assessment and Testing (CSAT) function, part of Global Cybersecurity, is accountable for Vulnerability Management, Secure Development, Threat and Controls Assessment (threat modelling), Third Party Security Assessment and Offensive Security and Cyber research. The function drives the identification, capture, assessment, testing and ultimately the remediation of threats, security defects, gaps and vulnerabilities across HSBC’s estate in concert with business and technology teams – on-premise, in the Cloud and resulting from third party engagements.
What You’ll Do
The role will lead and provide expertise covering activities including implementation and oversight of the Group’s Risk Management Framework applied to CSAT through ongoing and targeted risk and controls assessments, implementing and maintaining robust risk governance, and championing a proactive risk culture. They would work closely with partners across all lines of defence and is responsible for maintaining positive relationships with our regulators and external partners as needed.
The role holder will report to the Global Head of CSAT to oversee the risk and control portfolio related to CSAT function in Group CISO. Their primary stakeholder will be all the capability(control) owners within CSAT, designated lead from Chief Controls Office (CCO), Audit and Cyber Risk (2nd line)
Enabling the Businesses and Regions to execute their strategic growth objectives in a safe and secure way
Supporting business CISO’s to make decisions based on data to actively manage HSBC’s residual risk
Providing clear understanding of Cyber risks and the role they play in mitigating these risks
Partnership with Risk and Control Owners to ensure risk positions are understood and reflected in the design and operation of control activities managed by CSAT
Identifying, growing and supporting talent
The role will have global responsibility and will partner with Regions and Countries as required
The role holder will lead the CSAT Risk and Governance team to a values-based and outcome focussed way of working, including driving cultural change to deliver strong integrated risk management across.
Governance and Committee Memberships
Member of Cybersecurity Assessment and Testing Leadership Teams
Delegated Lead for the CSAT RCMM representing Global Head CSAT
Attend the Cyber RCMM
Stakeholder Management
Act as a primary point of contact for Global Head of CSAT for all matters related to risk & controls
Manage executive updates within and outside Cyber for all things representing CSAT as a function
Effectively manage relationships across CCO and 2LOD/3LOD partners – drive risk and audit reviews and subsequent actions through to resolution by partnering with the respective Cyber and CTO/CIO teams
Work to break down siloes across functions to deliver a holistic, end-to-end controls environment
Functional Risk & Controls lead for CSAT
Accountable for managing and governing the risk portfolio for the Global Head of Cybersecurity Assessments and Testing
Drive risk and control decision-making based on quality data and commercial analysis, actively challenging poor, inefficient or excessive controls, related tasks and behaviors.
Lead a structured approach to identifying, documenting and resolving key control issues in CSAT
Drive strategic enhancements to the design and implementation of the Risk Framework in the 1st line and through partnership and influence with ERM
Oversee emerging risks, strategic business initiatives and local change activity
Drive consistent and insightful reporting and escalation of identified issues and their status across the lifecycle
Drive consistent communication, clarifying impacts of change on the risk and control environment for HSBC
Partner with relevant services to design and implement future-fit risk management and regulatory requirements
Embed risk culture and change delivery capability across the GCIO CCO function
External environment
Identify trends to anticipate future developments in the risk and control environment
Stay educated and aware of developments in the broader technology environment and industry
Ensure ongoing awareness of the Regulatory environment and its impact on Cybersecurity and Technology
Leadership & Team Management
Lead the team within CSAT to manage operational risk through risk assessments, control environment reviews, issue lifecycle management and provide specialist risk and control knowledge and insights
Lead by example, demonstrate core behaviour and values including professionalism, teamwork, determination, and continuous improvement
Continuously invest in the team’s technical skills through ongoing learning, development and coaching
Lead the definition and delivery of a team strategy, aligned to HSBC and the GCIO Cyber function’s objectives
Define core delivery targets for the Team and ensure team delivery on commitments made
Coach team members to enable performance improvement and career development at HSBC
Leadership & Teamwork
Develop and maintain long term relationships with critical stakeholders internally and externally of all seniorities
Experience managing and coordinating a globally dispersed team
Experience managing within a complex matrix environment
Experience working across cultures
Role
What you will need to succeed in the role
Should have proven track record in technology risk management or cybersecurity leadership roles within the financial services industry, preferably within multinational banks
Demonstrated experience in managing technical cyber or infrastructure Risk & Control Teams, with a track record of driving results in a complex, matrixed organisation
Technical experience operating within a globally diverse, heterogenous technology environment preferred.
Strong leadership background with a proven track-record of managing a wide range of diverse stakeholders across all seniorities
In-depth technical knowledge of Network Cybersecurity and related infrastructure security concepts, implementations and products
Detailed knowledge of design and implementation of cybersecurity controls at the application and infrastructure layers preferred
Demonstrated understanding of Non-Financial Risk frameworks, relevant industry standards (e.g. NIST) and key regulatory themes in major markets (e.g. UK, US, HK, SG, etc.)
Experience in performing structured and repeatable risk and control reviews
Proven experience in a 2nd or 3rd line function with related oversight is also beneficial
Ability to work well under pressure, demonstrate flexibility and adapt to rapidly changing priorities
Ability to lead change and prioritise conflicting demands and problem solve in a dynamic environment
Proven track record of increasing business performance i.e. developing, aligning and translating strategies & plans to achieve business and functional goals
Proven ability to articulate complex issues concisely and in simple language to support problem analysis
Proven project management experience with an ability to influence senior stakeholders
Experience in writing and presenting board papers
You’ll achieve more when you join HSBC.
HSBC is an equal opportunity employer committed to building a culture where all employees are valued, respected and opinions count. We take pride in providing a workplace that fosters continuous professional development, flexible working and, opportunities to grow within an inclusive and diverse environment. We encourage applications from all suitably qualified persons irrespective of, but not limited to, their gender or genetic information, sexual orientation, ethnicity, religion, social status, medical care leave requirements, political affiliation, people with disabilities, color, national origin, veteran status, etc., We consider all applications based on merit and suitability to the role.
Personal d

Work arrangement
Hybrid