Lead Risk Manager - Data Management (Malaysia, India)

Job Summary

This role could be based in Malaysia or India. When you start the application process you will be presented with a drop-down menu showing all countries, please ensure that you only select a country where the role is based.

The Lead Risk Manager - Data provides first-line risk leadership, specialist oversight and constructive challenge across the Technology and Operations data risk portfolio. Responsible for establishing a coherent, evidence-based and sustainable approach to identifying, assessing, managing and reporting Data Risk across Technology & Architecture, Delivery, Resilience and Governance.

Primary key accountability is the end-to-end risk management of the Data Architecture & Platform domain together with its Data Platform Management process, including its supporting data platforms, capabilities and activities. This includes data sourcing, ingestion, transformation, storage, operational assurance, reconciliation, exception management, data consumption, change impact assessment, metadata, lineage, access, retention and disposal. The role ensures that risks are assessed based on the purpose and activities of the process, the data processed, downstream dependencies and the potential impact on regulatory reporting, financial crime controls, customer outcomes and critical business services. Also to ensure the Technology and ICS risks is managed accordingly

Secondary key accountability is to lead the Dataa Risk RCSA (Risk and Control Self-Assessment) programme across these domains, ensuring that process owners and risk owners consistently assess inherent risk, control effectiveness, residual risk, issues and emerging risk in accordance with the Enterprise Risk Management Framework, applicable Data Risk requirements and the Group’s control standards.

The role translates Data Risk policies, standards, regulatory expectations and control requirements into practical assessment methodologies, risk decisions and sustainable control outcomes. It provides independent, evidence-based challenge to process owners, technology leaders, platform teams, control owners and programme teams, while supporting them in identifying proportionate and implementable risk treatment.

The role maintains a portfolio-level view of Data Risk exposures, controls, issues, exceptions, dependencies and remediation activity. It provides senior management and governance forums with clear insights on material risks, systemic themes, overdue actions, control weaknesses and areas requiring management attention. 

Success in the role is demonstrated through:
•    Consistent and defensible assessment of Data Risk across the assigned portfolio.
•    Effective execution of the annual and event-driven RCSA lifecycle.
•    Clear ownership and accountability for risks, controls and remediation.
•    Earlier identification of risk arising from process, data, technology and organisational change.
•    Sustainable remediation of control weaknesses and risk issues.
•    Reliable and traceable risk information for management decision-making.
•    Stronger risk awareness and capability among process owners, and Technology teams stakeholders.

Key Responsibilities

Data Architecture & Platforms domain Risk Management

·       Provide end-to-end risk management for the Data Platform Management process, Data Architecture & Platforms domain, and its supporting platforms, applications and operational activities.

·       Assess the risks arising from data sourcing, ingestion, transformation, storage, reconciliation, exception management, change communication, consumption, retention, archival and disposal.

·       Assess the impact of platform failures or control weaknesses on ultimate downstream processes, regulatory reporting, financial crime controls, customer outcomes and critical business services.

·       Challenge accountability where ageing change, lineage, data quality or consumer impact requests remain unresolved.

·       Assess risk arising from migrations, platform consolidation, cloud adoption, application decommissioning, technology obsolescence and changes in sourcing or consumption patterns.

·       Ensure that infrastructure or architectural change is not automatically treated as a process change. Assess whether the change affects process activities, control design, governance, ownership, evidence, downstream dependencies or risk exposure.

Control Design, Monitoring, and Assurance

• Interpret control requirements and help process and control owners translate them into practical, sustainable controls.
• Review control descriptions against the 5W1H principles to ensure that the control objective, performer, activity, frequency, location, rationale, method and evidence are clear.
• Challenge controls that describe a policy expectation, system capability or process objective without defining an actual control activity.
• Promote the use of meaningful control indicators and operational evidence to identify deterioration in control performance.
• Assess whether control evidence is complete, reproducible, retained in an authorised repository and sufficient to support assurance or audit review.
• Identify duplication, fragmentation and gaps across controls and support control simplification where this does not reduce risk coverage.
• Support implementation of standardised control taxonomy, control design and control testing expectations across the assigned portfolio.
• Track RCSA progress, decisions, dependencies, overdue activities and management actions across the portfolio.
• Drive consistency across assessments while allowing proportionate treatment based on process materiality and risk exposure.
• Consult and guide respective Risk Managers from the domains around the Data Conduct Policy and its Standards.
•  

Data Risk RCSA Leadership

• Lead the end-to-end Data Risk RCSA programme across Technology & Architecture, T&O Delivery, Resilience, and T&O Governance domains.
• Establish a structured RCSA approach covering process review, risk identification, inherent risk assessment, control mapping, control effectiveness assessment, residual risk evaluation, issue identification and 2LoD sign-off.
• Ensure RCSA assessments begin with a clear understanding of the process objective, activities, data dependencies, critical outcomes, downstream consumers and potential failure scenarios.
• Facilitate workshops with risk managers, technology managers, control owners and subject-matter experts.
• Provide guidance to the respective Risk Managers on the application of impact and likelihood criteria, ensuring ratings are supported by documented evidence and credible risk scenarios.
• Challenge assessments that rely solely on policy applicability, system classification or theoretical exposure without establishing clear risk causality.
• Ensure controls are mapped to the correct risks and process activities, with clear descriptions covering who performs the control, what is performed, when and where it occurs, why it is required, and how it is evidenced.

Risk Identification, Assessment, and Treatment

• Lead the identification, assessment, and management of material data risks, ensuring comprehensive evaluation of inherent risk, control effectiveness, residual risk, issues, events, scenarios, and emerging risk drivers.
• Provide robust challenge and oversight of risk assessments and treatment plans, ensuring risks are appropriately mitigated through accountable actions, milestones, interim controls, target residual risk levels, and objective closure criteria.
• Assess risk concentrations, dependencies, and read-across impacts across applications, platforms, processes, countries, third parties, and transformation programmes to identify systemic exposures and interconnected risks.
• Maintain an enterprise-wide portfolio view of data risks, controls, issues, exceptions, and overdue actions, challenging risk acceptances, waivers, and exceptions while escalating material exposures in line with risk appetite

Key Stakeholders

• Process and service ownership: Global Process Owners, process owners, product owners, platform owners, application owners, service owners and control owners.
• Data management stakeholders: Chief Data Offices, Data Domain Owners, data owners, data stewards, data architects, metadata and lineage teams, and data quality teams.
• Data platform stakeholders: Engineering teams, platform operations, site reliability engineering, data sourcing teams, data consumer teams and operational assurance teams.
• Risk and control stakeholders: First-line Risk and Control, Governance Risk and Control, Operational Risk, Data Risk, Technology Risk, Cyber and Information Security Risk, Operational Resilience, and other Risk Framework Owners.
• Country stakeholders: Country risk managers, country technology managers and local process or control representatives.
• Assurance stakeholders: Second-line Risk, Compliance, Legal, Internal Audit, external assurance providers and regulatory engagement teams.

Qualifications

Education and Experience

• Bachelor’s degree (or equivalent experience) in Data, Technology, Risk, Audit, Law, Business, or a related discipline; postgraduate qualifications preferred.
• Extensive experience in data, technology, risk, controls, audit, or assurance within complex, regulated, and global organizations.
• Proven track record in risk assessments, control reviews, assurance activities, issue remediation, and executive governance reporting.
• Strong expertise in data governance, quality, privacy, sovereignty, records management, cloud and AI risks, with the ability to translate regulatory requirements into effective controls and influence senior stakeholders across all lines of defence.

Technical and Professional Knowledge

• Strong knowledge of risk management and assurance frameworks, including risk appetite, RCSA, control design and testing, issue management, audit, and governance.
• Expertise in data management disciplines, including data governance, quality, lineage, metadata, lifecycle management, records management, privacy, and data sovereignty.
• Understanding of regulatory and emerging risk domains, including BCBS 239, cross-border data requirements, Responsible AI, and generative/agentic AI governance.
• Familiarity with technology transformation, cloud platforms, and data tooling, including programme assurance, Azure/AWS environments, and analytics tools such as SQL, Python, Power BI, Tableau, and Collibra.

Certifications

• Relevant certifications are desirable and may include CRISC, CISA, CDMP, CIPM/CIPP, CISSP, ISO 27001, cloud, audit, risk or programme-management qualifications.

Skills and Experience

•    Project and Programme Management
•    Business Analysis and Requirements Management
•    Data Visualisation and Tableau
•    Data Modelling, Lineage and Data Quality
•    Operational Risk and Internal Controls
•    GRC Platforms and Risk Reporting
•    Internal Controls
•    Risk Management
•    Operational Risk
•    Process Management
•    Regulatory Environment - Financial Services
•    Standard Operating Procedures

About Standard Chartered

We're an international bank, nimble enough to act, big enough for impact. For more than 170 years, we've worked to make a positive difference for our clients, communities, and each other. We question the status quo, love a challenge and enjoy finding new opportunities to grow and do better than before. If you're looking for a career with purpose and you want to work for a bank making a difference, we want to hear from you. You can count on us to celebrate your unique talents and we can't wait to see the talents you can bring us.

Our purpose, to drive commerce and prosperity through our unique diversity, together with our brand promise, to be here for good are achieved by how we each live our valued behaviours. When you work with us, you'll see how we value difference and advocate inclusion.

Together we:

• Do the right thing and are assertive, challenge one another, and live with integrity, while putting the client at the heart of what we do
• Never settle, continuously striving to improve and innovate, keeping things simple and learning from doing well, and not so well
• Are better together, we can be ourselves, be inclusive, see more good in others, and work collectively to build for the long term

What we offer

In line with our Fair Pay Charter, we offer a competitive salary and benefits to support your mental, physical, financial and social wellbeing.

• Core bank funding for retirement savings, medical and life insurance, with flexible and voluntary benefits available in some locations.
• Time-off including annual leave, parental/maternity (20 weeks), sabbatical (12 months maximum) and volunteering leave (3 days), along with minimum global standards for annual and public holiday, which is combined to 30 days minimum.
• Flexible working options based around home and office locations, with flexible working patterns.
• Proactive wellbeing support through Unmind, a market-leading digital wellbeing platform, development courses for resilience and other human skills, global Employee Assistance Programme, sick leave, mental health first-aiders and all sorts of self-help toolkits
• A continuous learning culture to support your growth, with opportunities to reskill and upskill and access to physical, virtual and digital learning.
• Being part of an inclusive and values driven organisation, one that embraces and celebrates our unique diversity, across our teams, business functions and geographies - everyone feels respected and can realise their full potential.