Information Technology Risk Manager

Core Responsibilities in the 2LoD

• Independent Challenge: Reviewing and challenging the 1LoD's risk self-assessments (RCSA), project risk assessments, and incident root-cause analyses.
• Risk Oversight & Governance: Developing, maintaining, and updating the Technology Misk Management Framework (TRMF) and Cyber Resilience Framework (CRF).
• Key Risk Indicators (KRIs): Defining, monitoring, and reporting KRIs related to IT outages, cyber threats, patch management, and system availability to senior management and the Board Risk Committee.
• Policy Compliance: Ensuring all IT and cybersecurity policies align with both internal risk
• appetite statements and regulatory expectations.

Key Skills & Competencies:

RMIT Pillar / Focus Area 2LoD Risk Manager's Role

Governance & Framework

Ensuring the board and senior management receive

objective, accurate reports on tech risk. Verifying that a robust Technology Risk Management Framework (TRMF) is active.

Technology Risk Management

Overseeing the identification and assessment of emerging technology risks (e.g., Cloud, AI, API integrations) before deployment.

Cyber Health & Resilience

Challenging the effectiveness of the Cyber Defence Centre (SOC), vulnerability assessments, and penetration testing schedules.

Technology Operations

Monitoring critical system uptime, patch management backlogs, and capacity planning exceptions.

Structured Assessments

Reviewing mandatory regulatory assessments, such as the Technology Risk Assessment (TRA) for new digital services or cloud adoptions.