Technology Audit Vice President - Multiple Teams

Business Function

Group Audit helps the Board and Executive Management meet the strategic and operational objectives of the DBS Group. We provide independent assurance on whether the Group’s governance, risk management and control processes are adequately designed and operating effectively.

Our Technology Audit team comprises experienced professionals who act as trusted advisors on technology risk and controls. The team provides independent challenge and assurance across technology resilience, architecture, infrastructure, IT service management, change and configuration management, asset management, and technology risk governance.

We are seeking an experienced and independent technology risk professional at VP level who can evaluate complex technology environments, challenge architecture and control decisions, and assess technology risks from both a resilient architecture and risk governance perspective.

Responsibilities

• Lead and execute end-to-end technology audits covering resilient architecture, technology infrastructure, IT service management and technology risk governance.
• Independently assess whether technology architectures are designed and operated to support availability, recoverability, fault tolerance and continuity of critical business services.
• Evaluate resilient architecture patterns, including active-active and active-passive designs, availability zones, dependency management, automated failover, recovery mechanisms, capacity management and elimination of single points of failure.
• Assess the adequacy of architecture governance, including architecture standards, design reviews, technology risk assessments, exception management and approval of residual risks.
• Review technology risk management practices commonly overseen by Line 2, including risk identification, control assessment, risk acceptance, key risk indicators, thematic reviews, issue management and independent challenge of technology risk decisions.
• Lead audits and thematic reviews relating to production change governance, deployment practices, change risk assessment, configuration management, technology asset management, end-of-support and end-of-life risk, IT incident management and operational resilience.
• Perform incident back-testing to assess the background, impact, root cause, behavioural or process root cause, control breakdowns, recovery effectiveness and adequacy of management’s corrective actions.
• Evaluate whether technology risks and control weaknesses are identified, escalated and reported to senior management and governance committees in a timely and transparent manner.
• Assess the design and operating effectiveness of controls across complex technology environments, including on-premises infrastructure, cloud platforms, container platforms, middleware, databases, networks and third-party technology services.
• Develop risk-based audit strategies, scopes and procedures that provide effective coverage of emerging and systemic technology risks.
• Identify cross-cutting and thematic issues, distinguish symptoms from underlying root causes, and assess whether weaknesses are isolated or indicative of broader control deficiencies.
• Communicate complex technology and architecture risks clearly to senior stakeholders, with concise articulation of the business impact, risk exposure and required management actions.
• Produce high-quality audit reports with sound risk assessments, clear logic flow, balanced conclusions and practical recommendations that address the underlying root causes.
• Apply data analytics, automation and continuous monitoring techniques to improve audit coverage, identify control exceptions and support ongoing risk assessment.
• Monitor significant technology risks, regulatory developments, incidents, audit issues and remediation programmes, and advise Technology Audit management on matters affecting the Group’s control environment.
• Assess whether issues raised by Internal Audit, external auditors and regulators are remediated effectively, sustainably and within the committed timelines.
• Build trusted but appropriately independent relationships with senior stakeholders across Technology, Technology Risk Management, Architecture, Operations, Cybersecurity and business units.
• Coach and guide junior auditors, review their work and contribute to the development of the team’s technology and architecture audit capabilities.

Core Technology and Risk Experience

The candidate should have strong experience in resilient architecture design and technology risk management, including several of the following areas:

• Resilient software and infrastructure architecture, including redundancy, automated failover, fault isolation, recovery design and elimination of single points of failure.
• Architecture governance, design reviews, technical risk assessments and management of architecture exceptions and technical debt.
• Technology risk management or independent technology risk oversight, preferably within a Line 2 technology risk, operational risk or similar control function.
• IT service management, including production change, release and deployment management, configuration management, incident and problem management, and service continuity.
• Technology asset management, including inventory completeness, configuration management databases, software and hardware lifecycle management, and end-of-support or end-of-life risk.
• Development and operations environments, with a strong understanding of continuous integration and delivery, automated testing, deployment controls and production monitoring.
• Third-party technology risk, including outsourced services, cloud service providers, operational resilience, service-level monitoring and concentration or dependency risk.

Security Experience: Good to Have but Not Mandatory

• Understanding of secure architecture principles and security-by-design.
• Experience in assessing vulnerabilities identified through DevSecOps tools, including static application security testing, dynamic application security testing, software composition analysis and container security scanning.
• Cloud architecture and cloud-native technologies, including container platforms, orchestration, service mesh and infrastructure-as-code.
• Virtualisation, operating systems, databases, networks, middleware and other infrastructure technologies supporting critical business services.
• API architecture, microservices, distributed systems and management of internal and external technology dependencies.

Requirements

• Degree in computer science, information systems, cybersecurity, auditing or another relevant discipline.
• Minimum 10 years of relevant experience in technology audit, technology risk management, resilient architecture, engineering, infrastructure operations or a related field.
• Significant experience in at least one independent assurance or oversight role, such as Internal Audit, Technology Risk Management, Operational Risk, regulatory assessment or external technology assurance.
• Strong knowledge of resilient architecture principles and the ability to independently challenge whether proposed designs adequately address availability, recoverability and operational resilience risks.
• Proven experience conducting independent technology risk assessments, architecture reviews, thematic reviews or audits, with practical recommendations for control improvement.
• Strong understanding of technology governance and risk management frameworks, including the respective roles and accountabilities of the first, second and third lines.
• Strong understanding of Singapore’s technology regulatory landscape, particularly the MAS Technology Risk Management Guidelines, applicable MAS Notices, Cyber Hygiene requirements and outsourcing or third-party risk expectations.
• Ability to analyse complex technology environments, identify systemic risks and root causes, and translate technical findings into clear business and risk implications.
• Strong professional judgement and the confidence to provide constructive challenge to senior technology, architecture and risk stakeholders.
• Excellent written and verbal communication skills, including the ability to prepare concise, well-supported reports for senior management and governance committees.
• Ability to work independently, manage multiple priorities and lead complex audit assignments across different technology domains and geographic locations.
• Relevant professional certifications such as CISA, CISSP, CRISC are advantageous.

Location:

DBS Asia Central

Job:

Audit

Schedule:

Regular

Employee Status:

Full time