SVP, Information & Technology Risk (Infrastructure, Security & Resilience Risk Oversight)

GIC is one of the world’s largest sovereign wealth funds. With over 2,000 employees across 11 locations around the world, we invest in more than 40 countries globally across asset classes and businesses. Working at GIC gives you exposure to an extraordinary network of the world’s industry leaders. As a leading global long-term investor, we Work at the Point of Impact for Singapore’s financial future, and the communities we invest in worldwide.

Risk and Performance Management Department (RPMD)
We work collaboratively across teams to help guard against blind spots and ensure that all relevant risks are considered and duly addressed.

Information & Technology Risk Management

You will be a part of a team that independently protects the firm’s information technology assets, including business data, from external threats and operational risks, while supporting the firm’s digitalisation journey in a secure manner.

What will you do as an SVP, Information & Technology Risk (Infrastructure, Security & Resilience Risk Oversight)?

As a Senior Vice President, Information & Technology Risk (Infrastructure, Security & Resilience Risk Oversight) in GIC, you will operate as part of the Second Line of Defence (2LOD), leading independent oversight, assurance, and challenge over technology and cyber risk management activities across GIC. The role reports to the Head of Second Line of Defence / Information & Technology Risk Management within the Chief Risk Officer organisation.

You will bring deep expertise in infrastructure, cloud, cybersecurity, and operational resilience risk. The role ensures that technology infrastructure, security, and resilience risks are effectively identified, assessed, and managed in alignment with GIC’s risk appetite, regulatory expectations, and industry best practices.

Key Responsibilities

Infrastructure & Cloud Risk Oversight

• Provide independent oversight of risk management practices across the technology infrastructure estate, including data centres, compute, storage, networks, and end-user computing.
• Review and challenge the design and operating effectiveness of controls over hybrid and multi-cloud platforms, including configuration management, workload isolation, and cloud entitlement management.
• Assess infrastructure hygiene controls patching, hardening, asset and configuration management, capacity, and technology currency and challenge remediation of control gaps.
• Evaluate risks arising from infrastructure change, platform migrations, and automation, ensuring appropriate governance and rollback controls.

Cybersecurity Risk Oversight

• Provide independent oversight and challenge of the cybersecurity control environment, including identity and access management, privileged access, threat detection, and security operations (SOC).
• Review and challenge vulnerability and threat management practices, including penetration testing, and remediation of critical exposures within agreed risk tolerances.
• Assess the adequacy of security monitoring, logging, and incident detection capabilities against GIC’s threat profile.
• Advise on emerging cyber risks, including ransomware, supply-chain compromise, and AI-enabled threats, and challenge the sufficiency of mitigating controls.

Technology & Operational Resilience Oversight

• Provide independent oversight of technology and operational resilience arrangements, including availability management, disaster recovery, backup integrity, and cyber recovery capability.
• Review and challenge the identification of critical business services, impact tolerances, and mapping of supporting technology dependencies.
• Assess the scope, rigour, and outcomes of resilience and recovery testing, including scenario and severe-but-plausible testing, and challenge remediation of identified weaknesses.

Third-Party Technology Risk Oversight

• Provide independent oversight of technology and cyber risk arising from third parties, including cloud service providers, managed service providers, and material outsourcing arrangements.
• Review and challenge third-party due diligence, contractual control requirements, ongoing monitoring, and exit and substitutability planning.
• Assess compliance with regulatory expectations on outsourcing and third-party risk management, including cross-border and sub-contracting considerations.
• Challenge the adequacy of controls over third-party access, data handling, and interconnectivity with GIC environments.

Independent Oversight, Assurance & Incident Response

• Conduct thematic and targeted reviews to assess the adequacy and effectiveness of infrastructure, security, and resilience controls, and provide independent challenge to First Line of Defence (1LOD) risk assessments, control testing, and remediation plans.
• Act as the independent challenge function over Operational Risk Self Assessments (ORSAs) performed by the First Line of Defence (1LOD), challenging the completeness of risk and control identification, the rigour of control effectiveness ratings, residual risk conclusions, and the adequacy and timeliness of resulting remediation actions.
• Report key risk exposures, control weaknesses, and emerging issues to senior management, and governance committees, including risk appetite and key risk indicator reporting.
• Provide independent oversight of significant cyber, infrastructure, and availability incidents, ensuring proper escalation, root cause analysis, and remediation follow-through.
• Provide independent oversight and reporting over all Infrastructure, Cloud, and Security Operational Risk Events (OREs), including timely identification and escalation, validation of root cause and impact assessment, thematic and trend analysis, and reporting of event and remediation status to senior management and relevant risk committees.
• Partner with Internal Audit and other assurance functions to ensure comprehensive and non-duplicative coverage of technology risk areas.

Stakeholder Engagement

• Contribute to the enhancement of GIC’s technology risk frameworks, policies, standards, and risk appetite measures.
• Build effective relationships with Technology, Information Security, Operations, Compliance, and business stakeholders, and promote a strong risk culture across the organisation.

What qualifications or skills should you possess in this role?  

• Minimally 12–15 years of experience in technology risk management, information security, assurance, or audit management, preferably within financial institutions or regulated environments, including experience leading teams.
• Deep expertise across infrastructure, cloud, and cybersecurity risk, with practical understanding of operational and technology resilience and third-party technology risk.
• Proven experience assessing and challenging infrastructure and security controls , identity and privileged access, vulnerability and threat management, configuration and patch management, backup and recovery.
• Strong familiarity with technology risk and control frameworks (e.g., MAS TRM, MAS Outsourcing and Business Continuity guidelines, ISO 27001, NIST CSF, CIS, COBIT).
• Strong understanding of regulatory expectations relating to cyber resilience, operational resilience, outsourcing, and technology risk management.
• Excellent analytical, communication, and stakeholder management skills, with the ability to influence senior management and technical teams and to articulate risk in business terms.
• Relevant certifications advantageous (e.g., CISSP, CISM, CRISC, CISA, cloud security certifications).
• Commitment to continuous learning and staying current with the evolving infrastructure, cyber, resilience, and AI risk landscape.

Work at the Point of Impact
We need to be forward-looking to attract the right people to help us become the Leading Global Long-term Investor. Join our ambitious, agile, and diverse teams - be empowered to push boundaries and pursue innovative ideas, share your views, and be heard. Be anchored on our PRIME Values: Prudence, Respect, Integrity, Merit and Excellence, which guides us in how we make our day-to-day decisions. We strive to inspire. To make an impact.

Flexibility at GIC
At GIC, our offices are vibrant hubs for ideation, professional growth, and interpersonal connection.  At the same time, we believe that flexibility allows us to do our best work and be our best selves.  Thus, our teams come into the office four days per week to harness the benefits of in-person collaboration, but have the flexibility to choose which days they work from home and adjust this arrangement as situational needs arise.

GIC is an equal opportunity employer 
As an employer, we passionately believe every individual brings with them unique diversity of thought and perspectives to meaningfully enrich perspectives of GIC teams to drive competitive performance. An inclusive environment yields exceptional contribution.

Learn more about our Risk & Performance Management Department here:

https://gic.careers/group/risk-performance-management/