Director of Cyber & IT Resilience Risk Oversight

Bring your perspective to challenges that matter.

At AIA, your expertise and judgement can influence how we advance our Purpose of helping millions of people live Healthier, Longer, Better Lives. Across our diverse markets, you will take on complex challenges, collaborate with talented colleagues and bring together people, ideas and insights to shape important decisions and create lasting value for our customers and communities.

Join us to shape what comes next, broaden your influence and extend your impact across Asia.

About the Role

• Lead the independent second-line oversight, challenge, and assurance over Cyber Security, IT Operations, and Cyber Resilience risks.
• Ensure risks are identified, assessed, managed, monitored, and reported in line with the risk framework, risk appetite, regulatory requirements, and industry best practices, including acting as a trusted advisor and subject matter expert, while also supporting Group Tech Digital+ risk oversight.

Roles and Responsibilities:

Cyber Security Risk Oversight
·        Lead independent second-line oversight, challenge, and assurance of cyber security risks across the Group.
·        Assess the effectiveness of cyber security governance, risk management practices, control frameworks, and risk mitigation strategies.
·        Review cyber security risk exposures, threat trends, control weaknesses, and management actions to ensure alignment with the Group's risk appetite and risk management framework.
·        Provide effective challenge on cyber security strategies, risk assessments, exception management, and remediation plans.
·        Monitor the effectiveness of security controls and identify emerging cyber risks requiring management attention or escalation.

IT Operations Risk Oversight
·        Provide independent oversight of IT operations risk across critical technology services, infrastructure platforms, production environments, technology change, operational incidents, service resilience, and external technology dependencies.
·        Evaluate the effectiveness of controls designed to support availability, stability, reliability, and performance of critical technology services.
·        Review key risk indicators, operational loss events, service disruptions, and technology incidents to identify systemic issues and emerging risk trends.
·        Challenge management actions and remediation plans arising from operational risk events and control deficiencies.
·        Assess concentration, dependency, and systemic risks arising from critical technology services, cloud providers, and third-party technology arrangements.

Cyber & Operational Resilience
·        Lead second-line oversight of cyber resilience, and technology resilience capabilities.
·        Assess the adequacy of resilience strategies, recovery objectives, testing programmes, and preparedness activities across technology services.
·        Review resilience testing results, exercises, lessons learned, and remediation activities to ensure sustainable improvements.
·        Provide independent assurance regarding the effectiveness of resilience controls and programmes supporting business continuity and operational resilience objectives.
·        Monitor evolving resilience-related regulatory requirements and industry practices and assess implications for the Group.

Risk Assessments, Assurance & Thematic Reviews
·        Lead independent risk assessments, deep-dive reviews, thematic reviews, and assurance activities covering cyber security, IT operations, and resilience risk domains.
·        Identify cross-functional trends, control weaknesses, and opportunities for risk reduction through thematic analysis and read-across reviews.
·        Evaluate the effectiveness and sustainability of remediation actions for identified technology risk issues.
·        Drive continuous improvement by sharing lessons learned, industry practices, and recurring risk themes across business units and technology functions.

Strategic Programme & Change Risk Oversight
·        Provide risk oversight and challenge for major technology transformations, cloud initiatives, cyber security programmes, infrastructure modernisation, and digital transformation initiatives.
·        Assess key projects and programme risks and ensure appropriate controls are embedded throughout delivery lifecycles.
·        Support management in identifying emerging risks associated with new technologies, strategic initiatives, and evolving operating models.

Risk Governance, Reporting & Stakeholder Management
·        Prepare and deliver clear, evidence-based risk insights, thematic assessments, and reporting for senior management, governance committees, and regulators.
·        Monitor cyber, operational, and resilience risk profiles and support escalation of material concerns through appropriate governance channels.
·        Partner with Technology, Information Security, Operational Risk, Internal Audit, Compliance, and business stakeholders to strengthen risk management outcomes.
·        Act as a trusted advisor and subject matter expert while maintaining independence and effective challenge.
·        Support risk oversight activities relating to Group Tech Digital+ Malaysia and Philippines.

People Leadership
·        Lead, coach, and develop team member to build deep expertise in cyber, operational, and resilience risk oversight.
·        Promote a culture of collaboration, accountability, continuous learning, and constructive challenge.

Minimum Job Requirements:

·        Bachelor's degree in Information Security, Computer Science, Information Technology, Engineering, Risk Management, or a related discipline.
·        15+ years of relevant experience in cyber security, technology risk management, IT risk, operational resilience, technology audit, or related disciplines within financial services or other highly regulated industries.
·        Strong knowledge of cyber security, technology operations, and resilience risk management, including industry frameworks such as NIST CSF, ISO 27001, ISO 22301, COBIT, and applicable insurance and financial services regulatory expectations across Asia-Pacific.
·        Demonstrated experience in second-line risk oversight, assurance, governance, and control effectiveness reviews.
·        Strong experience overseeing cyber security, IT operations, and resilience programmes.
·        Experience supporting regulatory examinations, audits, and senior governance forums.
·        Ability to independently assess complex technology and cyber risks and provide credible challenge to senior stakeholders.
·        Strong analytical and critical-thinking skills with the ability to identify emerging risks and thematic trends.
·        Excellent written and verbal communication skills, including Board- and Executive-level reporting.
·        Proven people leadership and stakeholder management experience.

Build a career with us as we help our customers and the community live Healthier, Longer, Better Lives.

You must provide all requested information, including Personal Data, to be considered for this career opportunity. Failure to provide such information may influence the processing and outcome of your application. You are responsible for ensuring that the information you submit is accurate and up-to-date.