VP & Head of Operational Risk Advisory & Oversight - Group Technology & Transformation

JOB SUMMARY / INTRODUCTION VP, Head of Operational Risk Advisory & Oversight — Group Technology & Transformation The VP, Head of Operational Risk Advisory & Oversight — Group Technology & Transformation operates as a Second Line of Defence role within the Operational Risk Advisory & Oversight (ORA) function, under the direction of the SVP, Head of Operational Risk Advisory & Oversight. The purpose of the role is to lead portfolio-specific ORA coverage for the Group Technology & Transformation (GT&T) portfolio, ensuring that operational risks relating to technology services, platforms, infrastructure, data analytics, AI-enabled capabilities, information risk, change and transformation are effectively identified, assessed, challenged, escalated and governed in line with the Group Operational Risk Framework, risk appetite and regulatory expectations. The role executes the ORA coverage model and priorities defined at Group level, providing independent challenge and subject matter expertise to senior GT&T stakeholders, while maintaining clear separation from first-line ownership, technology delivery, control operation, remediation and independent assurance. The role acts as the designated portfolio lead and subject matter expert within ORA for technology, information risk, technology resilience, data and analytics risk and AI-related operational risk considerations, escalating material matters to the SVP where enterprise-level alignment, interpretation or governance positioning is required. KEY RESPONSIBILITIES • The role operates within Group Risk policies, approved governance standards, delegated authorities and the Group Operational Risk operating model. • The role is accountable for portfolio leadership, independent second-line challenge, stakeholder engagement, issue escalation, policy implementation oversight, thematic review execution and risk insight generation across the GT&T portfolio. • Lead second-line Operational Risk Advisory & Oversight coverage for the GT&T portfolio, aligned to Group-wide operational risk priorities, minimum standards and the ORA coverage model. • Act as the primary ORA point of engagement for senior GT&T leadership across BAU technology operations, platforms, infrastructure, data analytics, AI-enabled capabilities and change initiatives. • Maintain a risk-based portfolio coverage plan reflecting technology service criticality, transformation activity, data and analytics priorities, AI-related operational risk considerations, third-party dependencies, resilience matters, incidents, open issues and regulatory developments. • Provide portfolio insight and recommendations to the SVP where matters are material, systemic, cross-portfolio, regulatory-sensitive or require enterprise-level governance alignment. • Provide independent second-line challenge over technology, information, data and transformation-related operational risks, including risk identification, assessment, control design, control effectiveness, risk acceptance, issue remediation and tolerance breaches. • Challenge material risk acceptance decisions, control weaknesses, remediation plans and closure evidence, escalating to the SVP where risks are material, systemic or cross-cutting. • Ensure challenge activity is evidence-based, proportionate, clearly documented and aligned to the Group Operational Risk Framework and applicable operational risk policies. ○ Technology and information risk assessments ○ RCSA outputs and control assessments for GT&T ○ Technology change, transformation and digital initiative assessments ○ Data management, analytics and AI-related operational risk assessments ○ Operational resilience assessments for technology services ○ Third-party and outsourcing risk matters relating to technology dependencies ○ Material incidents, root cause analysis and remediation plans ○ KRI breaches, tolerance exceptions and policy exceptions • Act as the designated Line 2 subject matter expert within ORA for GT&T-related technology risk, information risk, technology resilience, data analytics risk and AI-related operational risk considerations. • Provide SME input covering information confidentiality, integrity and availability, data protection, information security risk, technology control align

Lead second-line Operational Risk Advisory & Oversight coverage for the Group Technology & Transformation (GT&T) portfolio, aligned to Group-wide operational risk priorities, minimum standards and the ORA coverage model. Act as the primary ORA point of engagement for senior GT&T leadership across BAU technology operations, platforms, infrastructure, data analytics, AI-enabled capabilities and change initiatives. Maintain a risk-based portfolio coverage plan reflecting technology service criticality, transformation activity, data and analytics priorities, AI-related operational risk considerations, third-party dependencies, resilience matters, incidents, open issues and regulatory developments. Provide portfolio insight and recommendations to the SVP where matters are material, systemic, cross-portfolio, regulatory-sensitive or require enterprise-level governance alignment. Provide independent second-line challenge over technology, information, data and transformation-related operational risks, including risk identification, assessment, control design, control effectiveness, risk acceptance, issue remediation and tolerance breaches. Challenge material risk acceptance decisions, control weaknesses, remediation plans and closure evidence, escalating to the SVP where risks are material, systemic or cross-cutting. Ensure challenge activity is evidence-based, proportionate, clearly documented and aligned to the Group Operational Risk Framework and applicable operational risk policies. Includes: technology and information risk assessments; RCSA outputs and control assessments for GT&T; technology change, transformation and digital initiative assessments; data management, analytics and AI-related operational risk assessments; operational resilience assessments for technology services; third-party and outsourcing risk matters relating to technology dependencies; material incidents, root cause analysis and remediation plans; KRI breaches, tolerance exceptions and policy exceptions. Act as the designated Line 2 subject matter expert within ORA for GT&T-related technology risk, information risk, technology resilience, data analytics risk and AI-related operational risk considerations. Provide SME input covering information confidentiality, integrity and availability, data protection, information security risk, technology control alignment.