Senior Manager - Risk and Compliance

Summary:

Candidate will lead the IT Risk Management, IT Compliance and IT Internal Audit in IFTAS. Cloud Security experience is desirable.

Experience:

Candidate must have 10+ years of total experience with 7-9 years’ of relevant experience. Experience/exposure to infosec/cybersecurity compliance requirements of Indian Banking industry is mandatory

Knowledge:

1. ISO 27001 and PCI DSS Standards & Controls  
2. Drafting / implementing Information Security Policy
3. IT Risk Management and IT Compliance
4. IT, Cyber Security best practices, processes, and tools
5. Cloud Security best practices

• Lead the ISO 27001 Implementation and ensure its compliance.
• Based on ISMS monitoring results, evaluate & recommend for Information Security Policy change.
• Standardization IT and Cyber Security practices as per ISO 27001 and another global standard.
• Establish acceptable limits for the application, network, or system usage in IFTAS.
• Ensure security review of the new requirement / projects are performed to ensure required security controls are incorporated.
• Team is responsible to conduct security review of IT Application / Infrastructure and provide the recommendations for improvement, the review includes hardening, access controls, privilege access, obsolete configuration, etc. 
• Team is responsible to conduct risk assessment of Asset / Service and provide recommendation with remediation steps.
• Review MSA/SoW/NDA, Contractual requirements of customers and vendors and advise on information security compliance.
• Facilitate Internal and external audit and track the findings for timely closure.
• Provide advice and input for Disaster Recovery, Contingency, and Continuity of Operations Plans.
• Monitor and evaluate the effectiveness of IFTAS Information Security controls / safeguards to ensure that they provide the intended level of protection.
• Create Policies, Processes, and Standards. 
• Develop methods to monitor and measure risk and compliance.
• Develop methods for Internal and third-party audit (e.g., cloud service providers, data centers). 
• Ensure information security requirements are incorporated in new IT Procurement / Outsourcing. 
• Ensure that Production and Non-Production (UAT, Testing) environments follow Information Security Policy. 
• Ensure that Information / Data Protection controls are implemented as per Information Security Policy.
• Identify, assess, and recommend cybersecurity controls or cybersecurity-enabled products for IFTAS.
• Adhere and promote the information security policy awareness and best practices in the company.