Technology Risk & Control Consultant

Your tasks

Join a role that’s centralto our Technology security and resilience architecture, offering a uniqueopportunity to shape our organisation's tech risk and digital operationsresilience strategy and operations.

As a Tech Risk & Control Consultant at LinkPay, you will play a pivotal role in shaping and implementing the organization’s Technology Risk and Digital Operations Resilience strategy and operations.

Leveraging your advanced knowledge and expertise in technology-risk and digital-operations resilience disciplines, you will identify, design, oversee, and mitigate compliance and operational risks in line with the organization's standards. You will collaborate with various stakeholders, including Compliance, Legal, Risk, Product, Engineering, and Outside Counsel, to develop and maintain a comprehensive view of the Technology Risk and Digital Operations Resilience posture and its impact on the business. Your ability to make calculated decisions, manage teams, and drive strategic projects will be crucial in ensuring the organization's adherence to regulatory obligations and industry best practices within MAS TRM and EU DORA domains. Your work will contribute to the long-term success and resilience of the organization in an ever-evolving Technology and Digital Operations Resilience landscape.

1.Regulatory Compliance & Gap Assessment

• Independently lead and implementdigital operations resilience and technology risk management strategies,policies, and processes to identify, assess, mitigate risks, and drivestrategic projects and initiatives to enhance the organization's technologyrisk management and digital operations resilience capabilities, in line withMAS TRM, EU DORA, industry best practices and the organization's standards andregulatory requirements.
• Conduct periodic gap assessmentsmapping current technology, cybersecurity, and third-party risk controlsagainst MAS TRM and DORA's five pillars (ICT risk management, incidentreporting, digital operational resilience testing, third-party risk management,information sharing) domains.

• Track regulatory developments,technical standards updates, and supervisory expectations issued by the ESAs(EBA, ESMA, EIOPA), MAS TRM & Outsourcing domains, and translate these intointernal policy and control updates.

2.Policy, Framework & Documentation

• Draft, review, and maintain ICTrisk management frameworks, technology risk policies, business continuity anddisaster recovery (BCP/DR) documentation, and third-party/outsourcing riskpolicies aligned to MAS TRM, DORA and industry best practices.
• Develop and maintain the ICTRegister of Information (RoI) required under MAS TRM and DORA, and equivalentthird-party/vendor risk registers, in line with industry best practices andoutsourcing guidelines.

• Prepare quarterly board andmonthly management-level reporting MIs, risk registers, and compliancedashboards summarising technology risk posture, control effectiveness, andregulatory readiness.

3.Third-Party & ICT Risk Management

• Own the third-party/ICT serviceprovider risk management lifecycle: due diligence, contractual clause review(including DORA-mandated contractual provisions), ongoing monitoring,concentration risk assessment, and exit strategy planning.
• Assess and classifycritical/important ICT third-party providers in line with MAS TRM and DORAoutsourcing/criticality criteria.

• Coordinate with procurement,legal, and vendor management teams to ensure new and existing technologycontracts meet regulatory requirements.

4.Incident Management, Testing & Resilience

• Support the design andmaintenance of ICT-related incident classification, escalation, and regulatoryreporting processes consistent with MAS TRM, Outsourcing and DORA incidentreporting timelines and notification requirements.
• Coordinate digital operationalresilience testing, including vulnerability assessments, scenario-basedtesting, and (where applicable) threat-led penetration testing (TLPT), workingwith Information Security and external testing providers.

• Support tabletop exercises,BCP/DR testing, and crisis simulation exercises to validate organisationalresilience against ICT disruption.

5.Governance, Training & Stakeholder Engagement

• Act as co-liaison withregulators, auditors, and examiners on technology risk and digital operationalresilience matters, including preparation of regulatory submissions andresponses to inspection findings.
• Design and deliver training andawareness programmes on MAS TRM, Outsourcing and DORA obligations fortechnology, risk, compliance, and business stakeholders.

• Support committee reporting(Risk & Compliance Committee, ICT Risk Committee) with clear,decision-ready materials on technology risk exposure and remediation status.
• Partner with Technology, Complianceand Legal teams to embed regulatory requirements into day-to-day operationalpractice.

Requirements

Education

• Bachelor's degree in InformationTechnology, Computer Science, Risk Management, Law, Finance, or a relateddiscipline.

• Minimum 5-8 years of experience orequivalent expertise in technology risk management, digital operationsresilience, information security, or a related field, with a focus on managingrisk identification, assessment, and mitigation within financial services, crypto-assets,or payments industry.
• Demonstrated hands-on experiencedesigning and implementing MAS TRM and DORA compliance programmes, includingICT risk frameworks, third-party risk management, and incident reportingobligations.

Knowledge& Technical Skills

• Strong working knowledge of ICTrisk management frameworks (e.g., NIST CSF, ISO/IEC 27001, COBIT) and how thesemap to MAS TRM and DORA control expectations.
• Familiarity with related EUregulatory frameworks (PSD2/PSD3, MiCA, GDPR) and Singapore (MAS TRM &Outsourcing Notices & Guidelines) to the extent they intersect withtechnology and operational risk.

• Understanding of ICTthird-party/outsourcing risk management, cloud risk considerations, and vendorconcentration risk assessment methodologies.

Certifications

• CISA, CRISC, CISM, CISSP, orequivalent technology risk/audit certification.