SVP Enterprise Risk Management and Data Privacy Officer

SVP Enterprise Risk Management and Data Privacy Officer

Risk Department

GCB4

Some careersgrow faster than others.

If you’re looking for a career that will help you stand out, join HSBC and fulfil your potential. Whether you want a career that could take you to the top, or simply take you in an exciting new direction, HSBC offers opportunities, support and rewards that will take you further.

We are now inviting qualified individuals to join this team in this specific role.

Global Enterprise Risk Management (ERM) is a sub function of Group Risk and Compliance. The ERM function will support the integration of our Group Framework and Appetite Management, and have broad oversight of the Risk Taxonomy. While the core risks of the bank remain consistent compared to a few years ago, the way in which they manifest, the speed to crystallisation and the connection points between them have become increasingly complex. It is therefore essential that we are equipped with the knowledge to navigate the dynamic and interconnected risk landscape of today. The objective of enterprise risk management is to develop a holistic, portfolio view of the most significant risks to the achievement of the Group’s most important objectives.

The role holder is also primarily responsible for ensuring that Thailand adheres to standards for the management of operational risk as set out in the Regional framework for Enterprise Risk and Operational Risk Management, and that Resilience Risks are managed within appetite. In addition, the role holder will act as the designated Data Privacy Officer in Thailand.

Principal responsibilities

The role holder will have responsibility for Thailand Enterprise Risk Management with specific focus on Resilience Risk Stewardship and Non-Financial Risk oversight.

• Active Risk Management in the market supported by Subject Matter Experts and regional management.This will cover acting as an effective risk steward for a range of Non-Financial Risks, for example across the resilience risk taxonomy (including data risk, third party risk, business interruption and incident risk, technology cyber security risk, transaction monitoring, change execution risk, facilities availability safety & security, etc.);
• Responsible for regular review of use and adoption of the Risk Management Framework (RMF), and provide timely escalation of potential breaches;
• Oversight of ‘Active Risk Management’ in the market based on Regional defined approach;
• Provide robust challenge and actionable, contextual guidance across all non-financial risks to ensure management of risk within appetite and enablement of business growth;
• Conduct thematic reviews across Thailand to ensure that risk and control environment is commensurate with the scale and nature of operations. This may include reporting into and presenting in the Risk Management Meeting;
• Assess compliance with Group policies, local regulations, and risk appetite. The role may interact with regulators and industry bodies related to Resilience Risk matters
• Ensure the integrity and timely completeness of risk and control identification, assessment and information within the Group’s Risk and Control system of record (Helios) as well as directing documented remediation plans for residual risks;
• Applies risk stewardship review and challenge over Resilience Risk RCAs and control environment;
•  Responsible for developing and promoting an increasingly insightful process based view of Enterprise Risk Management. Monitor internal and external risk trends and events, provide insights and learnings, and ensure that mitigating strategies and policies are developed
• Attend Thailand’s control meetings and non-financial risk governance forums, providing both Operational Risk oversight and robust and timely Risk Steward challenge of the First Line of Defence (1LOD) view of the resilience risk profile as required.
• Provide 2LOD oversight of top and emerging risks,ensuring Thailand can mitigate these timely and cost effectively
• In line with building a fungible Risk & Compliance team, other responsibilities and tasks may be required;

The role holder as designated DPO for Thailand will be responsible for stewardship of data privacy, including:

• Advising on data privacy and protection compliance obligations;
• Providing expert guidance, oversight and challenge on all aspects of data protection and privacy risk strategy and compliance focusing efforts on areas that present higher data privacy risks;
• Monitoring compliance with data privacy provisions and with HSBC Group policies relating to the protection of personal data, including the assignment of responsibilities, staff education and awareness training, and ensuring remediation of any related audit findings
• Reviewing and advising on Data Protection Impact Assessments (DPIAs) and monitoring performance of mitigations, where necessary;
• Acting as the escalation point internally and externally with data subjects and the regulatory authority;
• Advising on necessary safeguards and controls are in place to ensure compliance with requirements for international data transfers involving risks to personal data rights.
• Provide incident management advice and/or support as needed and ensure that data incidents and breaches are responded to and managed effectively with data subjects and that the relevant authorities are informed within necessary timeframes.

Leadership & Teamwork Expectations