Job Summary

Job Description: The Business Assurance function has responsibility for reviewing the controls and processes associated with the engagements and assures the businesses/ engagements on the applicable contractual obligations and risk arising from them. Through the business unit risk leaders, the function continuously drives risk culture within various lines of business as applicable.

To assist in operationalizing this program and embedding the framework across all areas of the organisation, the Business Assurance needs Account Risk Managers. The ARM will be aligned to Tier 1A  service delivery engagements and will be responsible for consolidating risks across risk and compliance functions. The ARM will act as a liaison for risk related items between the engagement and the larger R&C organization to maintain the risk register for respective engagements and covering all Line of Business.

Key Responsibilities

Role and Responsibilities

• The role requires thorough knowledge of managing end-to-end of Compliance/Information security/IT/ customer data protection programs in outsourcing service industry/ environment. It will also require the candidate to demonstrate advanced knowledge of Compliance monitoring mechanisms, auditing programs, processes and procedures and manage periodic risk assessments, internal assessments in customer accounts and/or enterprise-wide functions, and to highlight the potential risk exposures/ vulnerabilities and perform risk analysis. Play the role of Risk Advisor to the account leadership; Obtain thorough understanding of the issues and risks faced by the account and advise account leaders on risk remediation strategies and implementation of controls.
• The candidate will lead in the development/adoption and enforcement of Risk and Compliance programs, procedures and manage the Compliance (Information Security) programs in customer service delivery engagements organization wide and drive timely RCA for repeat risks and advise on sustainable processes. Facilitate activities on behalf of R&C for risk culture upliftment within the account.  Develop and implement information security awareness and training program.
• The candidate will need to Conduct regular review meetings with business leadership to provide insight of risks and compliance posture in the specific business areas, provide recommendations and act/escalate, where necessary, in response to non-compliances and identified risks/gaps. The person is expected to advise delivery leaders on controls implementation. Ensure proper risk governance along with SDMs, L4, L3 and ISD/MSD Head.
• The person in this role will lead the development/adoption and enforcement of Risk and Compliance programs, procedures, and standards.
• The roles require continuous engagements with key stakeholders along with participation in fortnightly governance calls and other calls with Delivery leaders pertaining to risk governance and ensure risks are clearly understood and action plans for remediation are documented and agreed upon
• The candidate will also be required to Coordinate / Follow up with support functions such as GIT, Physical Security, GWS, HR etc. on risk remediation
• The candidate will be responsible to maintain R&C calendar for the engagement and ensure smooth conduct of planned activities
• Candidate with extensive experience in gap assessing and analysing to determine the extent to which key business areas and/or customer service delivery accounts comply with HCL‘s baseline information security requirements, contractual and regulatory requirements with be an added advantage.
• Identification of non-IT risks (Financial, Regulatory, Operational, Legal and Compliance Items) across LoB.
• The person will be responsible to develop, review and deploy methodologies for risk assessment and prioritization, risk responses, and risk management capability assessments.
• The candidate is responsible to review the security and compliance control frameworks by evaluating the adequacy of system controls and recommends changes and improvements.
• Working knowledge of compliance programs such as PCIDSS, HIPAA, ISO 27001, SOC2, SOX, NIST, FISMA, COBIT. Any hands-on experience of conducting such assessments will be an added advantage.
• The role requires understanding of the control frameworks used during risk assessments and control selections for both IT and Non-IT domains.
• Proven ability to lead small teams dedicated to the performance of risk management and assessment responsibilities is an added advantage
• Coordinates between delivery and other R&C verticals and Support Functions while Focusing on Risk Minimization. Moreover, ensures all stake holders are appropriately engaged in this direction

Consultation and advisory on risk remediation for IT as well as non-IT risks across LoB

Skill Requirements

Primary Skill: Understanding of Information Security and standards such as ISO27001, NIST, CIS etc. / Knowledge of regulatory compliance such as SOX, PCI etc. / Knowledge of Risk Management and Control Auditing principles/ Knowledge of Data Privacy requirements / Technical knowledge of security principles around Network Security, Perimeter Security, Data Security, End User System security etc. Technical knowledge on Cloud Security, Threat analysis, VA/PT etc. Excellent communication skills (verbal and written) / Understanding of general IT Control framework / BCM Concepts

Secondary Skill: Analytical skills / Strategic Thinking / Ability to build relationship / Adaptable to new concerns and changing environments etc.

Required Experience and Educational Qualification:

• Minimum of 10-15 years of experience in Information Risk Management/Information Security or auditing.
• BE/BTech/BCA/BSc Comp Science/Any graduate with Computer Science diploma

Preferred certifications: CISA/CISM/CISSP etc.

Other Requirements

Other relevant skills:

• Strong communication skills
• Ability to multi-task, prioritize, and meet timelines on deliverables
• Proficient in MS Office
• Team Management Skills
• Able to translate contractual terms into information security controls

Additional details

• CV screening questions to ask candidates: Refer to the Role description
• Suggestive Keywords to search – Information security, ISMS, Data Privacy, GRC (Governance, risk and compliance), Risk management and ISO27001
• Competition org to look for: Any reputed Organization
• What all CVs to exclude:  Quality management system, QMS, Financials assessment/auditing, marketing, Call canter, Sales, Delivery

Experience guidelines - Minimum of 10-15 years of experience in Information Risk Management/Information Security or auditing