Chief Risk Officer — Secure Electronics Organisation

The mandate

A secure-electronics organisation is resetting certification and delivery processes. The incumbent CRO is preparing to leave. A planned replacement must strengthen independent challenge while first-line teams recover customer commitments.

Approximately 1,525 employees and material partners span engineering, programmes, manufacture, supply, quality, security, cyber and customer support from Singapore. The CRO owns enterprise risk, independent assurance, compliance coordination, resilience, issue oversight and board-committee reporting, with accountability to the Group Chief Executive and relevant committee.

Risk appetite must translate into certification decisions. Thresholds for incomplete evidence, unapproved configuration, expired concession, unqualified source and test anomaly should drive stop, escalation or board acceptance. Generic low tolerance does not help a programme facing a milestone.

Configuration risk will be assessed end to end. Requirements, design, component, software, manufacturing and delivered state must align. The CRO will sample whether approved change reached every affected system and supplier, focusing on silent divergence rather than document completion.

Certification plans need independent visibility. Evidence maturity, authority engagement, open findings and dependencies should be reported without programme optimism. Risk does not approve the design, but it challenges whether management's route and schedule remain credible.

Supplier recovery creates pressure to substitute. Alternate parts, processes or sources may change assurance, export and customer approval. The CRO will require provenance, qualification and effectivity before relief enters the delivery plan. Executive urgency cannot grant technical authority.

Test anomalies require disciplined escalation. Repeated resets, waivers or narrow retests can conceal systemic weakness. Risk will monitor recurrence, disposition independence and downstream effect. Schedule metrics should not discourage anomaly reporting.

Cyber and product security increasingly affect certification. Vulnerabilities, development environments and supplier software need ownership and evidence. The CRO will coordinate assurance while keeping authorised technical decisions distinct. Residual risks must be understood by the right customer and board level.

Operational resilience includes secure facilities, specialist skills, test equipment and suppliers. The organisation will run realistic loss scenarios and reconcile configuration and evidence after recovery. A fallback that produces hardware but cannot demonstrate controlled state is not viable.

Export and security controls remain delivery dependencies. Technical access, foreign-person conditions and customer caveats should appear in programme plans. The CRO will test assignments and information flows, ensuring compliance issues reach governance without spreading protected detail.

Issue closure will require effectiveness. Procedures, training and system changes should be tested in normal work. Extensions need compensating control and accountable risk acceptance. Repeated findings across programmes will be aggregated by control weakness.

First-line leaders own control. Risk will set framework, challenge, sample and escalate. Temporary support for remediation will have a dated handback. A programme leader who cannot explain certification and supplier exposure is not ready to attest.

Board reporting will show programme exposure, evidence confidence, concentration and decision. The CRO will state where the second line disagrees with management. Sensitive information may be compartmented, but the committee must still see consequence.

Risk information needs controlled lineage. Programme dashboards will identify the source, owner, refresh cycle and access boundary behind each conclusion. Where classified detail cannot enter a committee pack, the CRO will provide an independently verified exposure statement and a route for authorised directors to inspect the underlying evidence.

The replacement transition includes key regulatory, customer and board relationships. Risk-team capability in configuration, cyber, suppliers and controlled delivery will be strengthened, with succession beyond individual specialists.

What you will own

• Enterprise risk appetite and independent challenge.
• Certification and configuration assurance.
• Supplier provenance and substitution risk.
• Test, cyber and product-security oversight.
• Operational, export and security resilience.
• Issue effectiveness and first-line ownership.
• Board-committee and stakeholder assurance.
• Risk talent and succession.

The first 12 months

Within 45 days, map certification and configuration exposure, test supplier substitutions and escalate any uncontrolled delivery risk. Begin incumbent relationship handover.

By month six, implement programme risk thresholds, complete live resilience scenarios and establish evidence-backed first-line attestations. Strengthen technical risk capability.

At twelve months, achieve 95% verified closure of high-risk actions, reduce overdue certification dependencies by 50% and test every critical programme's configuration recovery. No unqualified component or unapproved change should enter delivered configuration, and all appetite breaches must reach the committee within standards.

What the committee will inspect

• Appetite thresholds driving live programme action.
• Certification evidence reported without schedule bias.
• Configuration changes propagated completely.
• Supplier alternatives supported by qualification.
• Recovery proving controlled product state.
• First-line leaders owning residual exposure.

The person

You bring 22–28 years in risk, quality, certification, security or programme leadership within aerospace, defence or secure electronics. Your record includes CRO or independent-assurance authority, Asian operations, suppliers, cyber and board committees.

Candidates must show an unapproved change they stopped and a programme attestation they challenged. The permanent role is onsite in Singapore. Security and export eligibility will be assessed.

Compensation and terms

Base compensation is SGD 420,000–570,000 plus annual incentive and long-term participation linked to certification confidence, control, resilience, delivery and succession. This permanent onsite Singapore CRO reports to the Group Chief Executive and relevant board committee. Planned replacement includes orderly stakeholder transition.

Confidentiality

The organisation, programmes, products, certification evidence, customers, suppliers, risks and security arrangements remain confidential. Further disclosure follows eligibility, conflicts and signed confidentiality. Applicants must not contact defence organisations or authorities to identify the client.