Deputy Director - IT Risk & Control (CIO)

First-Line Security Planning and Accountability Formulate and execute the ICT security work plan for our managed systems in alignment with approved cybersecurity strategy, policies, standards and risk appetite. Maintain clear first-line accountability for the security design, implementation and operation of controls within the our managed systems portfolio. Translate policy requirements into actionable control plans, operating procedures, technical baselines and delivery priorities for our managed systems. Secure and deploy the resources, capabilities and services required to achieve agreed security outcomes for the portfolio. Report the portfolio’s operational security performance, material exposures and delivery constraints to management and the second-line cybersecurity risk function. Operational Cyber Risk and Control Management Identify, assess, document and manage cybersecurity risks arising from systems, projects, operations, changes and related third-party services. Own and maintain first-line risk and control registers for the portfolio, including emerging risks, control deficiencies, findings and treatment plans. Implement and monitor preventive, detective, corrective and recovery controls for systems in accordance with approved requirements. Evaluate policy deviations affecting the portfolio, determine residual risk and mitigating measures, and prepare submissions for the appropriate system owner, risk owner and governance forum. Drive remediation of vulnerabilities, audit findings, security review findings and control weaknesses within agreed timelines. Collate accurate portfolio security metrics and evidence, review control performance regularly, and escalate risks that exceed approved tolerance or cannot be treated within plan. Security Engineering, Delivery and Control Implementation Embed security-by-design and privacy-by-design controls into projects, procurements, changes and technology lifecycles for systems. Translate approved security requirements into solution designs, technical controls, configuration standards and operational acceptance criteria for the portfolio. Ensure project and operations teams conduct required risk assessments, architecture reviews, vulnerability assessments, penetration tests, configuration reviews and code assurance activities. Review and validate that findings are risk-rated, assigned, remediated or mitigated before go-live and throughout each system’s lifecycle. Implement and maintain controls for identity and access management, privileged access, encryption, logging, patching, endpoint protection, data loss prevention, backup and secure configuration within the portfolio. Maintain implementation evidence and support technical verification by the second-line cybersecurity function.