System Risk Management Specialist

This position is assigned to SBI Neo Banking System and belongs to the Risk and Quality Management Office. It manages system risk for systems and services provided to financial institutions, working with development, operations and management to maintain reliability and security.

Responsibilities include identifying, analyzing and assessing system risks from availability, confidentiality and integrity perspectives. The role conducts risk assessments, maintains the risk register, and creates and maintains system-risk policies, standards and procedures.

The position handles responses to Financial Services Agency and supervisory-authority guidelines, including standards for system outages, outsourcing management and cybersecurity. It responds to system-risk requirements and reporting requests from financial-institution clients and supports internal and external audits by preparing and explaining audit materials.

When a major system outage occurs, the role evaluates risk, analyzes the scope of impact and reports to management. It verifies the effectiveness of recurrence-prevention measures, manages permanent countermeasures, and develops, exercises and reviews business continuity plans. Security duties include assessing security risks, managing response priorities, planning vulnerability assessments and penetration tests, managing their results, preparing and training the cyber-incident response structure, and assessing and regularly monitoring outsourced providers.

Required experience includes at least three years of practical experience in IT system risk management or information-security management, experience in a financial institution or in financial-system development or operations, and experience with system outage management, BCP development and internal-control responses. Knowledge and practical experience with Financial Services Agency guidelines, ISMS including ISO/IEC 27001, PCI DSS or FISC safety standards are welcomed. Relevant security certifications such as Information Technology Engineers Examination Registered Information Security Specialist, CISM or CISSP, experience at a bank, securities or insurance institution or financial-system SIer, and risk-management support experience at an audit corporation or consulting firm are also welcomed.

The position is full-time with an indefinite contract and a six-month probationary period. The workplace is in Roppongi, Minato-ku, Tokyo, with no transfer or workplace relocation. Remote work is available by consultation.

The premises are entirely smoke-free. The role may lead discussions with financial institutions and supervisory authorities, with possible progression to risk-management leadership or support for the CISO.