Regional Risk Manager - TRM and Cyber GRC

1. Purpose of the role

This role sits across both the EMEA Technology Risk Management group and the EMEA Cyber Governance, Risk and Control group. It is a first line regional role responsible for broad technology and cyber risk and control activity across the Middle East, while contributing to the wider EMEA operating model.

The role supports the identification, assessment, ownership, treatment and monitoring of technology and cyber risks. It also supports the design, implementation, operation, testing, evidence and remediation of controls. Reporting and management information are important enabling activities, but they are not the primary focus of the role.

The post holder will work as part of the established regional team and in close partnership with existing Technology Risk Management, Cyber GRC, Information Security and Technology colleagues. The role is intended to complement existing individuals in the region by adding capacity, coordination and specialist risk and control capability. It does not create parallel ownership or replace established accountabilities. The role reports locally to the Head of IT for the Middle East and maintains functional alignment with both the EMEA Technology Risk Management and EMEA Cyber GRC teams in London.

2. Background

• Operates within the first line Technology and Cyber organisation, reporting locally to the Head of IT for Dubai, with functional alignment to the EMEA Technology Risk Management and EMEA Cyber GRC teams in London.
• Provides a clear Middle East regional presence from Dubai and connects regional requirements, risks and control matters into the wider EMEA framework.
• Supports a strong, consistent and transparent technology and cyber risk and control environment aligned to internal frameworks, risk appetite and applicable regulatory expectations.
• Works with regional and global stakeholders to improve consistency while preserving local ownership, expertise and decision rights.

3. Principal accountabilities and responsibilities

Unless specifically stated otherwise, each responsibility below applies across both technology and cyber risk, controls, governance and assurance.

First line technology and cyber risk management

• Support the identification, assessment, ownership, treatment, acceptance, monitoring and evidence based closure of technology and cyber risks and issues across EMEA.
• Maintain an integrated, decision ready view of material risks, control gaps, issues, exceptions, actions, decisions, milestones, dependencies and remediation activity, linked to business impact, risk appetite and regulatory expectations.
• Embed practical risk management within day to day Technology and Cyber activities, programmes, projects, services and material change initiatives.
• Ensure risks and issues are clearly articulated, consistently assessed, linked to relevant work and assigned to accountable owners.
• Provide constructive first line challenge on risk assessments, treatment plans, evidence and closure proposals without assuming ownership held by service or control owners.

Technology and cyber risk and control management

• Support the design, implementation, operation, testing, evidencing, validation and improvement of proportionate technology and cyber controls.
• Help define clear control objectives, ownership, frequency, evidence requirements, performance measures, quality gates and escalation triggers.
• Identify recurring weaknesses and thematic issues, and support sustainable improvements to control design, operation and evidence quality.
• Help owners address overdue or Red and Amber items through practical recovery plans with clear owners, dates, blockers, escalation routes and closure criteria.

Regulatory compliance and assurance

• Coordinate first line responses to regulatory requirements, including DORA, EBA guidance, relevant Middle East expectations and entity or Head Office requests.
• Translate regulatory requirements into practical controls, processes, evidence and accountable actions.
• Maintain a controlled record of commitments, owners, inputs, dates, evidence, blockers, dependencies and escalation status.
• Maintain traceability between obligations, policies, standards, controls, risks, evidence, findings and remediation.
• Coordinate input from subject matter experts and control owners so submissions are accurate, complete, consistent, reviewed and evidence based while preserving their accountability.

Technology and cyber policy and standards governance

• Support policy owners with the review, update, approval and governance of technology and cyber policies and standards, maintaining alignment with regulation, internal frameworks and control obligations.
• Coordinate owners, reviewers and approvers through the policy lifecycle and annual approval cycle.
• Manage policy exceptions through documented justification, risk assessment, compensating controls, approval and review dates.
• Support technology and cyber policy improvement activity, including ECB related requirements, cyber skills framework operationalisation and associated process governance.

Technology and cyber metrics, KRIs and management information

• Coordinate the monthly technology and cyber metrics cycle with accountable data and metric owners.
• Help owners define and review KRIs, KCIs and KPIs, including thresholds, data sources, ownership and data quality controls.
• Coordinate action where performance is outside tolerance or evidence is incomplete.
• Provide clear analysis of trends, service health, control effectiveness, risks, issues, remediation progress and regulatory commitments.
• Support controlled automation of reporting processes using approved tooling, with clear ownership, testing, auditability and traceability.

Technology and cyber committee and executive reporting

• Support and coordinate technology and cyber reporting for the Security and Technology Risk Committee and provide reviewed Technology Risk Management and Cyber GRC input to other executive, entity and Head Office forums.
• Prepare concise, accurate papers covering material risks, controls, actions, service health and decisions.
• Maintain consistency and traceability across submissions while respecting forum ownership and approval routes.
• Coordinate contributors to meet deadlines, resolve data or evidence gaps and maintain clear records of decisions and actions.

Technology and cyber audit and remediation management

• Act as a senior first line coordination contact for technology and cyber Internal and External Audit activity, supporting accountable owners and clarifying ownership where responsibility is shared or unclear.
• Coordinate audit engagement, document requests, evidence, stakeholder responses, management responses and governance updates.
• Support agreement of practical remediation actions with accountable owners, milestones, due dates, closure criteria and validation requirements.
• Track findings and actions through to evidence based closure, reporting progress and escalating overdue or off track items through agreed routes.
• Identify recurring themes and use audit outcomes to improve controls, evidence quality and the wider risk and control environment.

Technology and cyber stakeholder leadership and engagement

• Act as a key supporting Technology Risk Management and Cyber GRC contact across EMEA, building effective relationships across Cyber Security, Technology, Risk, Compliance, Legal and Audit.
• Influence senior and distributed stakeholders to resolve control weaknesses, evidence gaps, overdue remediation and risks outside tolerance while preserving local accountability.
• Explain complex cyber, regulatory and control matters in clear business language.
• Coordinate regional and global stakeholders and provide constructive challenge through pragmatic, delivery focused working relationships.

First line technology and cyber governance, operating model and continuous improvement

• Support and improve the first line Technology Risk Management and Cyber GRC frameworks, operating model, service structure and service catalogue, with clear scope, ownership, decision rights, service levels, measures and evidence requirements.
• Apply clear RACI responsibilities, governance routes, escalation paths, review routes and approval standards across business as usual services, projects, commitments, audit actions and reporting outputs.
• Support governance forums with accurate papers, decisions, actions and risk insight, and partner with business, technology and control teams to embed ownership and remediation discipline.
• Maintain a reliable view of Run and Build activity linked to risks, actions, decisions and deliverables.
• Promote practical improvements to portfolio, workflow, reporting and evidence processes based on performance, risk, control, audit and stakeholder feedback.

The role may include the areas of responsibility described above as directed by line management, together with other tasks that may reasonably be required to support business, operational and regulatory needs.

4. Role scope and scale

• A shared regional role across the EMEA Technology Risk Management and EMEA Cyber GRC groups, with a focus on the Middle East.
• Broad first line responsibility across technology risk, cyber risk, controls, governance, regulatory activity, audit, issues and remediation.
• Works across infrastructure, applications, cloud, data, resilience, change, third parties and cyber security services.
• Has no direct reports and relies on collaboration, influence and clear coordination across regional, EMEA and global stakeholders.
• Adds capability and regional capacity while respecting the roles, expertise and ownership of existing team members.

5. Knowledge, skills and experience

• Strong experience in Technology Risk Management, Cyber GRC, technology risk, cyber risk, controls or assurance within a regulated environment.
• Practical experience operating in a first line role with responsibility for managing risks and supporting the design, operation and remediation of controls.
• Strong understanding of first line and second line responsibilities within an enterprise risk management framework.
• Experience assessing risks and controls across technology services, infrastructure, applications, cloud, data, resilience, change and third party arrangements.
• Experience coordinating regulatory, audit, issue and remediation activity, with strong evidence and records discipline.
• Knowledge of applicable regulatory expectations and recognised frameworks such as DORA, EBA guidance, NIST, ISO 27001 and COBIT.
• Experience working across regional and global teams and the judgement to add value alongside established colleagues without duplicating ownership.
• Strong stakeholder management, written communication, organisation and prioritisation skills, with the ability to influence without direct authority.

6. Key challenges

• Maintaining a clear and complementary role across two EMEA groups while providing coherent regional support across the Middle East.
• Embedding consistent risk and control practices across diverse entities, services, stakeholders and regulatory environments.
• Influencing distributed risk and control owners to address control weaknesses, evidence gaps and overdue remediation.
• Balancing concurrent risk, regulatory, audit, governance and remediation priorities without weakening day to day delivery.
• Translating evolving requirements and risk themes into practical, sustainable controls and accountable actions.

7. What we offer

For all the expertise and experience you bring to help us make a difference, it’s only sustainable if we support you to build your career and be your best self so we offer competitive company benefits, centred around promoting positive well-bring and work-life balance. We also believe in fostering a diverse and inclusive work environment, where all team members perspectives and contributions are valued. Initiatives in place which promote a diverse and inclusive culture and healthy work life balance include hybrid working, Sport & Social Clubs and Diversity and Inclusion networks.

As an employee of SMBC you have access to a host of both useful and exciting benefit offerings. See below some of the benefits on offer to you:

• Hybrid and flexible working 
• Competitive paid leave days
• Benefits to support your physical wellbeing, including private medical insurance and life and invalidity insurance 
• Various policies to support your mental wellbeing, including a robust behavioural health network with counselling and coaching services  
• Access a wide range of learning and development opportunities and career progression opportunities 
• Ambitious remuneration package

So, if you like a challenge and want to continuously grow and develop in a role where you will be supported along the way by a dynamic and diverse team, apply today!!