Group IT Risk & Information Security Officer

The Group IT Risk & Information Security Officer shall be responsible for the following functions across Famous Holdings Limited and its subsidiaries, working closely with Technology, Risk Management, Internal Control, Internal Audit and other relevant business functions. IT Risk Management: Conduct periodic IT and technology risk assessments across the Group, covering IT infrastructure, business applications, digital platforms, networks, databases, cloud services and third-party technology arrangements. Identify, assess and monitor emerging technology risks, cybersecurity threats, system vulnerabilities and potential exposures affecting business operations. Develop, maintain and periodically update the Group IT Risk Register in alignment with the Group Enterprise Risk Management Framework and approved Risk Appetite. Establish and monitor relevant IT Key Risk Indicators (KRIs), risk thresholds and early-warning indicators, escalating material exposures and breaches as appropriate. Evaluate technology risks associated with new systems, digital transformation initiatives, system upgrades, technology projects and changes to existing business processes. Monitor implementation of agreed IT risk mitigation measures and report significant outstanding exposures to the Head, Enterprise Assurance. Information Security and Cybersecurity Oversight: Assess the adequacy and effectiveness of information security and cybersecurity governance arrangements, policies, procedures and safeguards across the Group. Review cybersecurity controls covering network security, endpoint protection, firewalls, encryption, malware prevention, security monitoring and vulnerability management. Evaluate identity and access management arrangements, including privileged access, multi-factor authentication, user access rights and segregation of duties. Review vulnerability assessments, penetration testing reports, security assessments and other cybersecurity testing outcomes, and monitor remediation of identified weaknesses. Assess the adequacy of cybersecurity incident detection, reporting, response and recovery arrangements, including root-cause analysis and corrective actions. Monitor emerging cyber threats and security vulnerabilities and recommend appropriate risk mitigation and control improvements. Support information security awareness and cybersecurity risk sensitisation initiatives across the Group. IT Controls and Compliance Monitoring: Evaluate the design and operating effectiveness of IT General Controls (ITGCs), including logical access, change management, IT operations, system development and backup controls. Review application controls relating to transaction processing, data input, validation, authorisation, completeness, accuracy and integrity of system-generated information. Conduct periodic IT control reviews and testing to identify control deficiencies, process weaknesses and non-compliance with approved policies and procedures. Assess the adequacy of controls over system administration, privileged activities, audit trails, system logs and monitoring of critical IT operations. Review controls over IT asset management, software licensing, configuration management and technology infrastructure. Maintain records of identified IT control exceptions and monitor the implementation and closure of agreed corrective actions. Recommend improvements to strengthen the Group's IT control environment and reduce operational, financial, regulatory and reputational exposures. IT Systems Assurance and Technical Review Support: Provide specialist technical support to Enterprise Assurance in conducting IT and syst