Associate Director, Global Business Resilience

What is the opportunity?

CACEIS was set up in Cyberjaya, Malaysia in July 2023 with approximately 1,000 employees, with the acquisition of RBC investor Services’ European business and Malaysia centre of excellence.

As a centre of excellence, the team in Malaysia provides asset services, custody and payments for clients in Europe (Belgium, Ireland, Luxembourg, Switzerland and United Kingdom) with a global operating model that maximises efficiencies across time zones, supports 17/5 operational capability with follow the sun model, enhances scalability of our global operations and the implementation of standardized processes.

The purpose of this position is to ensure the effective Business Continuity Management practices are in place CACEIS Malaysia; This includes the quality, efficiency and risk mitigation strategies of the plans by providing oversight of the BCPs (business continuity plans), BIAs (business impact analyses), Pandemic Plans, WARP offsite testing, Contact (call tree exercises). The Business Resilience Associate Director acts as Operations coordinator for all Crisis Management activities and to ensure all crises are properly assessed, escalated and that subsequent activities are in line with the Crisis Management Policy and protocols. Additionally, this position is the local representative of all Business Continuity Management activities CACEIS Malaysia, ensuring connections between business activities and regional representatives. To ensure all Technology Infrastructure incident priority are properly assessed and managed according to Major incident Management (MIM) procedure.

Business Continuity Management All aspects of the Business Continuity Lifecycle at Global and Local Country Business Level, including:

• Assessment of resilience to risks and exposures.
• Planning and documentation of resilience capabilities.
• Validating the adequacy of existing resilience capabilities.
• Reporting on inherent and residual resilience risks.
• Supporting management of the resolution of major incidents and crisis events.
• General administration of the program elements.

Coordinates tactical activities of BCM globally and key focus at local country level including:

• Provide expertise and decision support for the Location Incident Management Teams in Location level application of the Lifecycle.
• Remain apprised of environmental and other risks with the potential to disrupt business
• Conduct BCM exercises to validate planning assumptions and test controls (including work area recovery, contact exercises and simulations as required).
• Keeping the communication channel open with timely update of issues relating to BCM until resolution is achieved.
• Providing support and coverage, as part of the global team for events regardless of their location.
• Identify gaps in application capabilities requirements working with the business and IT to resolve the gap through acceptance, work arounds or an enhancement project.
• Provide analysis and insights on platform specific KRI’s to support management reporting and investigate and resolve deficiencies. Partnering with CACEIS BCM 2LOD teams, Functional teams, Regional and Business Line Executive to create, coordinate and maintain a multi-discipline Incident Management Team to provide a resilient response to incidents.
• Track outstanding audit items or regulatory findings relative to the respective business lines, as they relate to BCM, assuring established timelines are met and keeping the management informed of the status
• Collect impacts from incidents on operational teams, clients and regulators and channeling the outcome to all relevant stakeholders
• Maintaining a working relationship/liaison with other Crisis Management Teams
• Support business change initiatives as it relates to BCM, including completion of associated BIA, BCP and required recovery testing
• Support Client engagement for any Due Diligence written and face to face presentation requirements.

Operational Resilience

• Support the implementation of Regulatory Requirements and evolving requirements from other regulators.
• Stage 1 – identify important business services (Service Impact Assessment) and map people (linked to additional focus on critical employees WFH and concentration), process and technology
• Stage 2 – set impact tolerances and develop communication plans
• Stage 3 – scenario test our ability to remain with the impact tolerances upon material changes
• Stage 4 – create a self-assessment document and conduct lessons learned exercises.

Incident Management

• Facilitate P1 & P2 incidents for the entity to restore critical services by driving the incident to resolution through engagement of appropriate business and technical resources and managing communication to internal stakeholders.
• Partners with Operations and Technology Infrastructure to optimize and enhance improvements post incidents for lesson opportunities. Develop and implement Country Crisis Management activities (documentation & exercise), designed to manage operational and reputational risk that could potentially harm CACEIS’s brand.

Region: APAC

Working hours: 9:00AM to 6:00PM

What will you do?

• To effectively understand the risks of securities products namely, Funds, Custody, Market Services and Private Equities.
• Integration of Local Crisis Management team with CACEIS.
• Adherence to the relevant policies at all times.
• Ensure timely completion of core practices for assigned Business/Products and locations.
• Ensure monthly engagements takes place timely.
• Ensure that CACEIS IS BCM is align to CACEIS BCM Framework.
• Adoption of CACEIS BCM template for 2024 yearly review.
• Completion of BIA review Exercise for CACEIS IS.
• Migration of staff members contact details into CACEIS Call Tree system (depending on GDPR requirement).
• Completion of Call Tree testing for Local CMT.
• Due Diligence.
• New joiner training on CACEIS BCM programme.
• Yearly review of Crisis Management Handbook.
• Table-top exercise for local CMT (semi-annually).
• Responsible in activating Incident Management Team (IMT) and Incident Recovery Team (IRT) to manage any critical BCP scenarios.
• Service Impact Assessment.
• Harm Impact Assessment.
• Dependency Mapping.
• Scenarios Testin
• Self-Assessment.
• Ops Resilience/DORA exercise.
• Monthly KRI Dashboard. Gallagher Reporting / Alert (TBC for CACEIS).
• Environmental screening (internal & external).
• Supporting Internal Capital Adequacy Assessment Process – ICAAP.
• Access Review.
• Improved and timely BCM communication established through continued review of available MY governance, and communication tools.
• Audit Engagement – Support Functions Audit.
• New CACEIS MY Office*.
• CACEIS BCM tools*
• TOM.
• Monitoring of WFH/WFO to capture office utilization, monitoring, tracking and escalating technical issues to the right resolution parties and produce monthly reporting for Malaysia stakeholders.