Director, OTCR, CIB

The purpose of this role is to act as the primary point of contact within the Second Line Operational, Technology and Cyber Risk (OTCR) function for the Corporate and Investment Banking business (the Business), covering all non‑financial risk matters across operational processes, technology platforms, information security and cyber resilience.

The role provides independent oversight, challenge and assurance to ensure that the Business identifies, assesses, manages and escalates Operational, Technology and Cyber risks in line with the Group’s Enterprise Risk Management Framework (ERMF) and the OTCR Risk Type Framework, and that material risks and control weaknesses are transparently governed.

• Material risks across operations, systems, technology resilience, cyber security and data are appropriately identified and assessed;
• Controls are designed, implemented and operating effectively; and
• Breaches, incidents and weaknesses are escalated in line with appetite, policy and governance requirements.

This is delivered through close collaboration with other Second Line risk teams, including Technology Risk, Information & Cyber Security (ICS), Third Party Risk and relevant Centres of Excellence, as well as enterprise‑wide SMEs.

The role holder is expected to demonstrate deep subject matter expertise in one or more OTCR domains, including:

• Operational and process risk within Corporate and Investment Banking;
• Technology risk, system stability, resilience and change delivery;
• Information and Cyber Security risk, including data protection and control frameworks.
• The role holder must understand the interdependencies between operational processes, technology platforms and cyber vulnerabilities, and how weaknesses in one domain can amplify risk in another.
• Coverage includes all Second Line responsibilities within the Group’s Enterprise Risk Management Framework (‘ERMF’). This includes oversight, review and challenge of all risk decision making within the Business.

From a regulatory perspective, the role requires a strong understanding of global supervisory expectations relating to operational resilience, technology risk and cyber security, including banks’ obligations to demonstrate robust identification, monitoring and control of risks arising from end‑to‑end processes, critical systems and digital infrastructure

The role holder is expected to understand how these requirements are embedded within the OTCR Risk Type Framework, and how they interact with other Risk Type Frameworks under the ERMF.

The Second Line OTCR function is responsible for independent oversight and challenge, ensuring that risks are appropriately identified, assessed, controlled and managed within risk appetite, and that material issues are escalated, tracked and remediated. The role holder is accountable for leading the delivery of Second Line OTCR responsibilities for the CIB business, including continuous improvement of risk transparency, control effectiveness and governance outcomes.

• Demonstrate deep understanding of the Business strategic priorities to effectively advise and challenge decisions across all relevant Risk Types. Demonstrated experience/SME in an equivalent 1st line/2nd line role managing one or more areas of the Business particularly Operations is a strong plus.
• Review and recommend resolutions to risk-related escalations from the Business, keeping in mind Operational, Technology and Cyber Risk Appetite thresholds, policies, and procedures.
• Work with OTCR Policy team to clarify / interpret any policy-related matters or queries from the Business.
• Identify internal / external insights and emerging risks that can impact the Business.
• Attend relevant Business Risk committees representing Risk in…