Job Summary

Domain & Role: Engagement Risk - Senior Manager

Band & Sub Band: E3.2

Key Responsibilities

Role Description – Task and Responsibilities

• Lead teams and efforts to ensure effective execution of periodic risk assessments and drive integration of remediation efforts with the risk management process
• Partner with service delivery leadership to both communicate and manage risk in delivery to an acceptable level
• Working experience in any two of the compliance programs (PCI DSS, HIPAA, ISO 27001, SOC2, SOX, NIST, FISMA, COBIT)
• Facilitate ISO 27001 certification and surveillance audits
• Support client audits for Information Security
• Partner with R&C Certifications team for preparation and conduct on internal ISO 27001 audits
• Respond to client assessments/questionnaires related to Information, Facility and Cyber security
• Partner with the delivery team to increase the level of awareness of compliance with policy and process
• Lead and perform activities to help measure and monitor compliance with contractual security requirements, company policies and procedures to ensure the account is compliant and audit ready 
• Lead different compliance & audit testing programs and support successful completion of various external compliance certification programs and internal compliance assessments
• Proven ability to lead small teams dedicated to the performance of risk management and assessment responsibilities.
• Ability to provide effective management of junior employees.
• Develops and provides appropriate guidance on solutions to mitigate risks and enhance system security
• Coordinates with other R&C representatives to build out robust compliance program components to include processes, procedures, and technologies.
• Deep understanding of privacy and business continuity requirements and support R&C Privacy and BCM teams in execution of their respective program
• Communicates Risk to non IT business owners and support function such as delivery, HR, GWS, Physical Security, Legal, Contracting and others
• Communicate risk at all levels of management up to and including C-Level executives.

Translate business, industry, and regulatory requirements into information security objectives and associated tactical/strategic information security initiatives 

Skill Requirements

Primary Skill:  Required to have excellent understanding of the IT Control framework, in particular risk assessment and control selection

Secondary Skill: Understanding of general IT Control framework, BCM Concepts, Privacy, Vendor risk management, Legal and Regulatory requirements in relation to Information Security and IT

Required Experience and Educational Qualification:

• Minimum of 12 - 18 years of experience in Information Risk Management/Information Security or auditing.
• BE/BTech/BCA/BSc Comp Science/Any graduate with a Computer Science diploma

Other relevant skills:

• Proven track record in client-facing communications and/or senior management communications
• Ability to multi-task, prioritize, and meet timelines on deliverables
• Proficient in MS Office
• Team Management Skills
• Able to review and translate contractual terms into information security controls
• Ability to work in a virtual team with help of tools and technologies
• Ability to handle conflicting situations & should have strong verbal, written communication & analytical skills
• Must  have a systematic and pragmatic approach to problem solving
• Good interpersonal skills, high standards of professional behavior in dealings with business customers, colleagues and staff
• Have a good technical awareness and the aptitude to remain up to date with information security and IT developments
• Excellent leadership, facilitation and organizational skills
• Interpersonal and presentation skills
• Ability to function with little supervision

Good cross-cultural awareness and sensitivity

Other Requirements

Additional details

• CV screening questions to ask candidates: Refer to the Role description
• Suggestive Keywords to search - CISA/CISSP/CISM / CRISC and ISO27001, Team management, Client facing
• Competition org to look for: Any reputed Organization
• What all CVs to exclude:  Quality management system, QMS, Financial assessment/auditing, marketing, Call canter, Sales, Delivery

Experience guidelines - Minimum of 15 - 18 years of experience in Information Risk Management/Information Security or auditing