Strong knowledge of banking regulation and supervisory expectations for operational resilience, Disaster Recovery, Business Continuity, outsourcing and cloud, including CBB requirements and comparable frameworks in other Group jurisdictions such as MAS and FFIEC.
Working knowledge of operational resilience concepts, including important business services, impact tolerances, service mapping and severe but plausible scenario testing.
Knowledge of relevant standards and good practice, such as ISO 22301 and the BCBS Principles for Operational Resilience.
Knowledge of ITIL processes, particularly Configuration, Asset, Change, Availability and Capacity Management.
Knowledge of ServiceNow CMDB and the Common Service Data Model, ITOM Discovery and Service Mapping, and Hardware and Software Asset Management.
Knowledge of resilience patterns for on-premises, Azure, AWS and SaaS environments, including backup, replication and cyber recovery.
Bachelor’s degree in computer science or a related field.
Business continuity or Disaster Recovery certification, such as BCI CBCI or MBCI, or DRII CBCP.
ITIL 4 Foundation certification or higher.
At least 10 years’ experience in IT, preferably within financial services or another regulated environment.
At least 5 years’ proven experience in technology resilience, Disaster Recovery, Business Continuity or IT risk management.
Hands-on experience governing CMDB and IT asset data quality, ideally in ServiceNow.
Experience planning and leading Disaster Recovery tests and exercises across on-premises and cloud services, including third-party and SaaS providers.
A track record of driving standards across teams without direct line authority.
Ability to deliver multiple objectives while maintaining a high standard of work.
Ability to influence and hold technical teams to agreed standards without direct line authority.
Analytical and evidence-driven approach, with healthy scepticism toward untested assumptions.
Ability to communicate technical risk as business impact to senior stakeholders.
Strong planning, organisation and follow-up skills.
Ability to remain calm, structured and decisive under pressure, particularly during incidents or recovery exercises.
Responsibilities
Maintain the Group IT technology resilience framework, standards and minimum requirements for on-premises, cloud and SaaS environments, aligned to the Group Operational Resilience framework.
Work with Business Continuity Management and Operational Risk to map important business services to their supporting applications, infrastructure, data and third parties, and maintain these mappings in ServiceNow.
Translate approved impact tolerances into technology recovery objectives (RTO and RPO) and report gaps between required and demonstrated recovery capability.
Define resilience requirements for new applications, technologies, cloud services and major changes, and assure conformance through Technology Risk Assessments and the Design Authority, including the Core Banking Replacement programme.
Conduct resilience risk assessments and Risk and Control Self-Assessments, including System Security Plans where applicable, and track findings to closure.
Maintain the inventory of resilience, Disaster Recovery, Business Continuity, outsourcing and cloud regulatory requirements, including CBB, MAS, FFIEC and other jurisdictional expectations; monitor developments and assess Group IT conformance.
Own the Group IT Disaster Recovery framework and standards, and ensure Group application DR plans, runbooks and recovery procedures are complete, current, accessible and approved by their owners.
Design and govern the annual technology resilience testing programme, covering DR tests, cloud resilience exercises, SWIFT tests and tabletop exercises based on severe but plausible scenarios; validate achieved RTO and RPO, issue test reports and track remediation.
Maintain the Group IT Business Continuity Plan to reflect changes to technology, operations, locations and services, and keep Resilience One up to date.
Set backup and restore standards, including protected or immutable copies for critical data, and assure periodic restore testing with the Infrastructure teams.
Set standards for local Disaster Recovery activities in overseas units, provide advice and monitor implementation through key risk indicators.
Provide proactive support for Managed Assets (hardware and software) and Managed Configuration within the GIT Process and Control Framework.
Drive the resilience outcomes of ServiceNow ITOM and ITAM, including Discovery reconciliation, Service Mapping for critical services, and Hardware and Software Asset Management, in partnership with the ServiceNow platform team.
Specify and own automated ServiceNow controls that assure Production and DR parity; own the parity exception process and monitor supporting change management controls, including changes from strategic programmes.
Monitor CMDB completeness and accuracy for critical services and escalate data gaps to accountable configuration item owners.
Use asset and configuration data to identify end-of-life or unsupported technology, single points of failure and concentration risk supporting critical services, and track remediation.
Maintain the Managed Availability and Capacity process, including minimum monitoring, event management and capacity standards for critical services.
Participate in post-incident reviews of major incidents and analyse lessons from external events, including cyber incidents and service outages, and recommend enhancements to resilience controls.
Coordinate with Information Security on cyber recovery, including destructive attack and ransomware scenarios, cyber tabletop exercises, alignment of incident response playbooks with DR runbooks, and assurance that critical data can be recovered.
Assess third-party, cloud and SaaS provider resilience at onboarding and periodically, covering recovery capability, test evidence, exit plans and concentration risk.
Provide regular reporting on technology resilience posture, key risk indicators, test outcomes and open findings to Group IT management and the Group Operational Resilience Committee.
Collect quarterly resilience key risk indicators from the units, analyse trends and recommend corrective actions.
Support staff awareness and training on recovery procedures, escalation protocols and individual responsibilities during incidents.
Stay current with emerging threats, regulatory developments, cloud resilience practices and industry good practice.
Give Group IT management and the Group Operational Resilience Committee an evidence-based view of technology resilience using service mapping, configuration and asset data, and test results.
Ensure resilience requirements are designed into projects, major technology changes and transformation programmes rather than retrofitted.
Hold service, platform and configuration item owners to consistent resilience standards across Head Office and overseas units.
Desired Qualifications
ServiceNow certification, such as Certified System Administrator, CMDB or ITOM.
CRISC or CISM certification.
Job Purpose:
The Technology Resilience Manager provides Group-wide assurance that the technology supporting Bank ABC’s important business services can withstand, respond to and recover from disruption within approved impact tolerances. The role supports Group IT’s technology resilience governance, recovery capability, and configuration and asset integrity processes across on-premises, cloud and SaaS environments, with ServiceNow as the system of record. The role sits within Group IT as the first line of defence. It sets standards, assures conformance and reports on resilience posture. Accountability for designing, building, operating and recovering individual services, and for the accuracy of their configuration and asset data, remains with the respective service, platform and configuration item owners.
Principal Responsibilities, Accountabilities and Deliverables of Role:
1. Resilience governance and operational resilience
Maintain the Group IT technology resilience framework, standards and minimum requirements for on-premises, cloud and SaaS environments, aligned to the Group Operational Resilience framework.
Working with Business Continuity Management and Operational Risk, map important business services to their supporting applications, infrastructure, data and third parties, and maintain these mappings in ServiceNow.
Translate approved impact tolerances into technology recovery objectives (RTO and RPO) and report gaps between required and demonstrated recovery capability.
Define resilience requirements for new applications, technologies, cloud services and major changes, and assure conformance through Technology Risk Assessments and the Design Authority, including the Core Banking Replacement programme.
Conduct resilience risk assessments and Risk and Control Self-Assessments, including System Security Plans where applicable, and track findings to closure.
Maintain the inventory of resilience, Disaster Recovery, Business Continuity, outsourcing and cloud regulatory requirements (including CBB, MAS, FFIEC and other jurisdictional expectations), monitor developments and assess Group IT conformance.
2. Recovery capability
Own the Group IT Disaster Recovery framework and standards. Ensure that DR plans, runbooks and recovery procedures for Group applications are complete, current, accessible and approved by their owners.
Design and govern the annual technology resilience testing programme, covering DR tests, cloud resilience exercises, SWIFT tests and tabletop exercises based on severe but plausible scenarios. Validate achieved RTO and RPO, issue test reports and track remediation.
Maintain the Group IT Business Continuity Plan so that it reflects changes to technology, operations, locations and services, and keep Resilience One up to date.
Set backup and restore standards, including protected or immutable copies for critical data, and assure periodic restore testing with the Infrastructure teams.
Set standards for local Disaster Recovery activities in overseas units, provide advice and monitor implementation through key risk indicators.
3. Configuration and asset integrity
Provide proactive support for Managed Assets (hardware and software) and Managed Configuration within the GIT Process and Control Framework.
Drive the resilience outcomes of ServiceNow ITOM and ITAM, including Discovery reconciliation, Service Mapping for critical services, and Hardware and Software Asset Management, in partnership with the ServiceNow platform team.
Specify and own the automated ServiceNow controls that assure Production and DR parity. Own the parity exception process and monitor the change management controls that support it, including for changes from strategic programmes.
Monitor CMDB completeness and accuracy for critical services and escalate data gaps to the accountable configuration item owners.
Use asset and configuration data to identify end-of-life or unsupported technology, single points of failure and concentration risk supporting critical services, and track remediation.
4. Availability, capacity and incident learning
Maintain the Managed Availability and Capacity process, including minimum monitoring, event management and capacity standards for critical services.
Participate in post-incident reviews of major incidents and analyse lessons from external events, including cyber incidents and service outages, and recommend enhancements to resilience controls.
5. Cyber and third-party resilience
Coordinate with Information Security on cyber recovery: destructive attack and ransomware scenarios, cyber tabletop exercises, alignment of incident response playbooks with DR runbooks, and assurance that critical data can be recovered. Information Security remains accountable for cyber defence, detection and incident response.
Assess the resilience of third-party, cloud and SaaS providers at onboarding and periodically, covering recovery capability, test evidence, exit plans and concentration risk. Vendor Management remains accountable for the commercial relationship.
6. Reporting and awareness
Provide regular reporting on technology resilience posture, key risk indicators, test outcomes and open findings to Group IT management and the Group Operational Resilience Committee.
Collect quarterly resilience key risk indicators from the units, analyse trends and recommend corrective actions.
Support staff awareness and training on recovery procedures, escalation protocols and individual responsibilities during incidents.
Stay current with emerging threats, regulatory developments, cloud resilience practices and industry good practice.
Job Context (Circumstances & environment surrounding the job): Bank ABC is consolidating its technology estate through the One Bank and Core Banking Replacement programmes, increasing its use of cloud and SaaS services, and implementing ServiceNow as the single system of record for IT service and operations management. Supervisors increasingly expect banks to evidence that important business services can be recovered within tolerance, not only that DR plans exist. The main contribution of the role will be to:
Give Group IT management and the Group Operational Resilience Committee an evidence-based view of technology resilience, built on accurate service mapping, configuration and asset data, and test results.
Ensure that resilience requirements are designed in early to projects, major technology changes and transformation programmes, rather than retrofitted.
Hold service, platform and configuration item owners to consistent resilience standards across Head Office and overseas units.
Knowledge:
Strong knowledge of banking regulation and supervisory expectations for operational resilience, Disaster Recovery, Business Continuity, outsourcing and cloud, including CBB requirements and comparable frameworks in the Group’s other jurisdictions (e.g. MAS, FFIEC).
Working knowledge of operational resilience concepts: important business services, impact tolerances, service mapping and severe but plausible scenario testing.
Relevant standards and good practice, such as ISO 22301 and the BCBS Principles for Operational Resilience.
ITIL processes, particularly Configuration, Asset, Change, Availability and Capacity Management.
ServiceNow CMDB and the Common Service Data Model, ITOM Discovery and Service Mapping, and Hardware and Software Asset Management.
Resilience patterns for on-premises, Azure, AWS and SaaS environments, including backup, replication and cyber recovery.
Education/Certificates
Bachelor’s degree in computer science or a related field.
Business continuity or Disaster Recovery certification (e.g. BCI CBCI or MBCI, DRII CBCP).
ITIL 4 Foundation or higher.
Desirable: ServiceNow certification (e.g. Certified System Administrator, CMDB or ITOM), and CRISC or CISM.
Experience
At least 10 years’ experience in IT, preferably within financial services or another regulated environment.
At least 5 years’ proven experience in technology resilience, Disaster Recovery, Business Continuity or IT risk management.
Hands-on experience governing CMDB and IT asset data quality, ideally in ServiceNow.
Experience planning and leading DR tests and exercises across on-premises and cloud services, including third-party and SaaS providers.
Track record of driving standards across teams without direct line authority.
Personal Attributes
Results-oriented, with the ability to deliver multiple objectives while maintaining a high standard of work.
Able to influence and hold technical teams to agreed standards without direct line authority.
Analytical and evidence-driven, with a healthy scepticism towards untested assumptions.
Clear and effective communicator, able to translate technical risk into business impact for senior stakeholders.
Strong planning, organisation and follow-up skills.
Able to remain calm, structured and decisive under pressure, particularly during incidents or recovery exercises.