Senior Manager, Data Risk Oversight
The AI & Emerging Technology Risk Oversight team, part of Global Risk Management, is an independent second-line function. We provide oversight and challenge of how Manulife manages its AI, technology, cyber, data, and emerging technology risks as the company expands its use of data and new technologies.
Manulife is seeking an experienced Senior Manager, Data Risk Oversight, to build the frameworks, standards, methodologies, and tools that enable effective data risk management and oversight across the enterprise, and to provide independent challenge of the systemic and strategic data risks that shape the company's overall risk posture.
This role is distinct from the segment-level oversight performed by Information Risk Officers, who use these frameworks and tools to challenge individual business decisions and initiatives. It does not own or operate data controls, perform first-line data activities, approve initiatives, accept or own data risk, or manage remediation. These responsibilities remain with the first line and the relevant governance forums.
Position Responsibilities:Design, maintain, and continuously improve the enterprise data risk oversight framework, standards, methodologies, and tools that enable data risk to be managed and challenged consistently across the organization.
Build the practical oversight tools, guidance, templates, and assessment approaches that segment Information Risk Officers use to perform their challenge of first-line data risk decisions.
Aggregate and analyze data risk across segments and functions to identify concentrations, themes, systemic exposures, and gaps in the enterprise risk posture.
Provide independent challenge of the overall effectiveness, consistency, and maturity of Manulife's AI and data risk program.
Set enterprise standards and oversight expectations across the data lifecycle, including data governance, quality and fitness for use, lineage and provenance, retention, minimization, and disposal.
Define enterprise standards and oversight approaches for data privacy, consent, sensitive-data classification, and access control, in coordination with Privacy, Legal, and Compliance.
Establish risk expectations and oversight approaches for third-party, shared, and AI-generated (synthetic) data, including the right to use it, its quality, its security, and whether its source is known and appropriate.
Challenge data bias, representativeness, and ethical data use at a program level, particularly for data that feeds AI, and elevate systemic concerns about potential harm, unfairness, or misuse.
Oversee enterprise data risk issues, ensuring significant and systemic weaknesses are identified, aggregated, and escalated to senior management and governance committees for timely resolution.
Define enterprise data risk metrics and key risk indicators, and produce independent reporting, thematic reviews, and cross-segment dashboards for management and committees, feeding into Board-level reporting.
Ensure the framework and oversight activities remain aligned with relevant OSFI guidance (including E-21 operational and data risk and E-23 model risk), enterprise data risk standards, and applicable privacy regimes.
Provide independent, strategic challenge on enterprise initiatives, AI use cases, and emerging technologies involving data, coordinating with the AI Model Risk, AI Technology & Cyber, and Emerging Technology teams so oversight is coordinated and non-duplicative.
10+ years of relevant experience in data risk, data governance, privacy, enterprise risk management, technology risk, internal audit, or a related discipline.
Bachelor's degree in Computer Science, Data Science, Information Management, Statistics, Mathematics, Engineering, Risk Management, Law, or a related field.
Proven experience designing data risk frameworks, standards, methodologies, or oversight tools, ideally in a second-line or independent assurance role in financial services, insurance, or another regulated industry.
Strong understanding of the core areas of data governance, including data quality, lineage, classification, retention, privacy, consent, and access management.
Experience aggregating and analyzing risk across a large, complex organization to identify systemic themes, and familiarity with relevant OSFI guidance (including E-21 operational and data risk, E-23 model risk, B-10 third‑party, and B-13 technology and cyber) and privacy laws such as PIPEDA and other global privacy rules.
Experience…
(If this job is in fact in your jurisdiction, then you may be using a Proxy or VPN to access this site, and to progress further, you should change your connectivity to another mobile device or PC).