VP, Risk & Controls Officer (Risk Governance & Assurance), Technology Group
Singapore, SG
GIC is one of the world’s largest sovereign wealth funds. With over 2,000 employees across 11 locations around the world, we invest in more than 40 countries globally across asset classes and businesses. Working at GIC gives you exposure to an extraordinary network of the world’s industry leaders. As a leading global long-term investor, we Work at the Point of Impact for Singapore’s financial future, and the communities we invest in worldwide.
Technology Group
We experiment, design, and lead a 24×7 global business where we support core capabilities in asset management, trading, investment operations, and risk management. We deliver secure, reliable, and integrated solutions, and provide insights on new, and emerging technologies.
Infrastructure & Cybersecurity Resilience (ICR)
We design, build, and secure the technology foundations that power GIC’s global investment operations. We aim to deliver resilient, scalable, and secure infrastructure that empowers our people and businesses to perform securely, efficiently, and effectively.
What impact can you make in this role?
We are seeking a Risk & Controls (R&C) professional to be embedded within the Technology function supporting investment and corporate business units. This role will be part of the R&C function which comprises team members driving R&C Strategy and Standards settings.
Operating within the First Line of Defence, this role partners with engineering, architecture, and platform teams to ensure technology risks are effectively managed and controls are embedded across systems and delivery processes. The role focuses on enabling secure, resilient, and well-governed platforms that support investment decision-making and operations.
What will you do as a VP/SVP Risk & Controls Officer (Risk Governance & Assurance)?
Incident & Problem Management
- Lead and coordinate the incident and problem management process across the technology function, partnering with teams in all divisions to ensure incidents and problems are managed with strong risk discipline
- Provide risk input into major incident reviews and problem records
- Drive Root Cause Analysis (RCA) and manage the Corrective and Preventive Actions (CAPA) process to permanent closure
- Track remediation of control failures and gaps identified in technology incidents through to sustainable closure, feeding learnings back into controls development
- Translate operational failures into clear control improvements and business impact
Audit Engagement
- Partner with technology teams to prepare for audits, strengthening controls and pre-empting findings ahead of engagements
- Lead internal and external audit engagements on behalf of the first line, collating and reviewing control artefacts
- Act as the single point of contact to manage audit responses; review responses and coordinate management review before submission
- Coordinate with the second-line IT risk management function, which governs external audit engagements
- Translate audit observations into clear, actionable remediation plans
- Track audit findings and remediation commitments through to closure
Standards & Procedures
- Establish and maintain fit-for-purpose policies, standards, and Standard Operating Procedures (SOPs) across control domains, partnering with embedded risk and controls specialists and technology teams to define them
- Centralise the source of these documents for the technology function and manage version control and accessibility
- Ensure standards and SOPs are complete and high-quality to enable evidence-based Operational Risk Self-Assessment (ORSA) and continuous controls monitoring (CCM)
- Drive internal compliance and incorporate feedback from embedded risk and controls teams on standards and SOPs
- Translate control requirements into clear, usable documentation and guide teams on how standards apply to day-to-day controls and compliance checks
Controls Design, Implementation & Monitoring
- Design and embed controls across the technology lifecycle (SDLC, change management, access controls, data governance) within the domain
- Ensure controls are integrated into delivery workflows (e.g., DevOps, CI/CD) and validate adherence to governance processes, evidenced by Key Control Indicators (KCIs)
- Maintain and enhance Operational Risk Self-Assessments (ORSA), progressing toward evidence-based, continuous controls monitoring (CCM)
Operational Resilience
- Support system resilience, disaster recovery, and service continuity frameworks
Monitoring & Reporting
- Develop and track Key Risk Indicators (KRIs) and Key Control Indicators (KCIs) for the domain
- Produce risk dashboards and insights for senior stakeholders
- Highlight emerging risks across systems, platforms, and dependencies
Third-Party Governance
- Support risk assessments and controls for vendors and service providers, ensuring appropriate oversight of outsourced technology services
Stakeholder Engagement
- Act as a liaison between technology teams (first line), IT risk management (second line), and internal audit (third line)
- Build strong relationships with engineering and platform teams
- Promote a risk-aware culture while supporting delivery and innovation
What qualifications or skills should you possess in this role?
- Minimally 6 years in technology risk, IT controls, operational risk, governance, IT operations, or IT audit within financial services
- Strong understanding of technology risk and IT service management (incident, problem, change); audit processes, evidence standards, and control testing; and policy, standard, and SOP frameworks with their documentation governance, with hands-on experience in one or more of these domains a strong plus, whether managing audit engagements, running RCA/CAPA remediation across teams, or authoring standards and SOPs to enable ORSA or continuous controls monitoring
- Rigour in root-cause analysis and driving corrective and preventive actions to sustainable closure; excellent writing, structuring, and review skills
- Knowledge of control frameworks (e.g., COSO, COBIT) and operational risk methodologies (ORSA)
- Ability to balance risk management with delivery priorities; strong stakeholder management and communication skills
- Degree in Information Systems, Computer Science, Finance, or a related field; relevant certifications (e.g., CISA, CRISC, CISSP) are advantageous
Work at the Point of Impact
We need to be forward-looking to attract the right people to help us become the Leading Global Long-term Investor. Join our ambitious, agile, and diverse teams - be empowered to push boundaries and pursue innovative ideas, share your views, and be heard. Be anchored on our PRIME Values: Prudence, Respect, Integrity, Merit and Excellence, which guides us in how we make our day-to-day decisions. We strive to inspire. To make an impact.
GIC is a Great Place to Work
At GIC, our offices are vibrant hubs for ideation, professional growth, and interpersonal connection. At the same time, we believe that flexibility allows us to do our best work and be our best selves. Thus, our teams come into the office four days per week to harness the benefits of in-person collaboration, but have the flexibility to choose which days they work from home and adjust this arrangement as situational needs arise.
GIC is an equal opportunity employer
As an employer, we passionately believe every individual brings with them unique diversity of thought and perspectives to meaningfully enrich perspectives of GIC teams to drive competitive performance. An inclusive environment yields exceptional contribution.
Learn more about our Technology Group here:
https://gic.careers/group/technology-group/