Director, Operational, Technology and Cyber Risk, Digital Assets

Job Summary

• Uphold the integrity of risk, in particular, ensuring that operational risks are properly assessed, that risk / return and cost / benefit decisions are made transparently on the basis of proper assessment, and are controlled in accordance with Risk Appetite.
• Provide practical implementation guidance on Risk including Operational, Technology and Cyber Risk (OTCR) Policy & Standard in an effective and consistent manner.
• Identify, assess, monitor, and mitigate risks related to the daily operations.
• In conjunction with first line of defence (1LOD), ensure any concerns on key controls, operational risk events and its risk impact are understood and escalated on a timely manner. 
• Drive comprehensive, high quality root cause analysis of operational risk events, review and provide robust challenge on remedial action plans proposed by 1LOD Risk / Control Owners. 
• Ensure new and material change in products / services / processes conforms with the Transaction Processing Policy, Change Management Policy, and Product Governance Policy. 
• Oversee and monitor the execution of inherent and residual risk ratings as per the Risk Control Self-Assessment (RCSA) Framework by 1LOD. 
• Ensure local regulatory requirements are met pertaining to risk including operational risk management, prudential standards and governance and operational standards.
• Role requires a combination of expertise in financial services, blockchain systems, digital asset products, regulatory compliance, and risk management frameworks.

Responsibilities

• Identify and assess operational risks across digital asset products, including blockchain infrastructure, custody solutions, liquidity management, and payment systems
• Analyze risks related to smart contract vulnerabilities, stablecoin reserve management, cybersecurity threats, and compliance with regulatory requirements.
• Evaluate third party risks in partnerships with custodians, exchanges, and third-party service providers.
• Provide timely advice, support and challenge to enable compliance with all relevant laws and regulations and support the transition to pro-active and pre-emptive risk mitigation.
• Develop and implement mitigation strategies for identified risks, such as robust cybersecurity measures, operational redundancies, and business continuity plans.
• Lead the response to operational incidents like system outages, fraud, or liquidity crises.
• Collaborate (with Legal, IT, etc) to ensure timely resolution of any operational risk events.
• Assess the stability and reliability of the blockchain infrastructure supporting the stablecoin.
• Collaborate (with IT, Product, etc) to mitigate risks related to smart contracts, network attacks, and key management.
• Ensure robust cybersecurity measures are in place to protect reserves, transaction data, and user accounts.

Requirements

• Local regulatory requirements (e.g. HKMA ECF ORM Certification)
• Operational risk management experience
• A clear understanding of the Bank’s approach to the management of operational risk, or equivalent experience gained in other organisations.
• Sound judgement and courage necessary to perform a control role and maintain effective working relationships.
• Excellent analytical skills and sound judgement in a rapidly changing environment
• Effective verbal and written communication skills
• Ability to present complex risk issues to senior and non-technical stakeholders
• Excellent interpersonal skills, multicultural awareness and sensitivity
• Proactive risk management. 
• Language: English
• Training: Role-specific training which are mandatory and developmental
• Other training as deemed mandatory and updated on a periodic basis