Governance, Risk Management & Compliance Head (Infosec)
- Qualitykiosk
- 15 - 24 years
- Mumbai
- 8 hours ago
- Email to a friend
- Report this job
Job Description
Title: Risk Management & Compliance Head (Infosec)
The Person
- Self-starter who works under minimal supervision and is prompt with actions, responses & decisions.
- Effective Program Manager who can seamlessly track and manage multiple tracks
- Fixated on time bound closure of deliverables and can get work done accordingly
- Customer centric focus with design thinking mindset and approach.
- Loves to constantly being challenged to learn new and emerging technologies.
- Willing to take a whatever it takes attitude to solve the problems with perseverance and persistence.
- Someone who can make good cybersecurity decisions for the organization and customers by being fluid, adaptable and willing to change gears based on needs.
- Interested in technology and the dark side of technology and managing disparate sources of information.
- Proficient in team building and upskilling and continually raising the service bar
The Opportunity / Challenge
Challenging opportunity to lead the Risk Management & Compliance program for QualityKiosk, the worlds leading software testing services company and work on myriad of new age technologies and platforms such as:
- Firewalls, Endpoint and Server Security tools and technologies
- Cloud Hosted Solutions Security and Mobile Lab Security Setup
- VDI Security and environment for critical infosec controls
- SIEM External threat monitoring and correlation
- Perimeter and Network Security tools and controls
- VAPT tools and technologies for public and custom apps
- User and Behavioural Analytics
- Quality Audits / Regulatory Laws Compliance
- Operational Risk Management domains across the Organization.
- BCP, DR and WFH initiatives and framework controls
Key Expectations
- QualityKiosk (QK) is a trusted partner to the banking industry and 90% of its customers are banks where there is a major customer and regulatory emphasis on information security to safeguard their customer's financial and personal information.
- Since any security breach can mean detrimental consequences for a banking institution, QualityKiosk stands committed to this resolve of making sure the security of our banking and other customers is not compromised at any time resulting in any kind of Non Compliances (NCs) .
- This we do by regularly investing in best of the breed technologies and tools such as Cloudsek for scanning of open vulnerabilities, Paladion for log analysis and correlation, Sophos for endpoint and server security, Cisco ATP for email security, DLP for preventing sensitive mail and customer information leakage etc. and by working closely with Security Advisors such as SecurBay, Paladion, Cloudsek and New Concept towards further enhancing and scaling up our security framework to match that of the Banks stringent and globally accepted security standards.
- QualityKiosk also hosts ODCs and Secure Operating Zones to deliver cutting edge services to banks that undergo stringent audits by BSI India leading to ISO 27001 Quality Certification besides others such as ISO 17025 and ISO 9001 etc. Our philosophy and endeavour is to be compliant with widely accepted Quality Standards, both in letter as well as in spirit.
- In order to sustain and further mature the Infosec program, the incumbent, in his role as Risk Management & Compliance Head, is expected to completely own and be responsible for planning, directing and coordinating QK's information security policies, setting procedures and guidelines to ensure that all information systems are functional, secure and safeguarded throughout the organization and are in compliance with privacy, customer trust and information security laws and regulations applicable to banks and financial institutions.
- Towards achieving these objectives, the Risk Management & Compliance Head should look for ways and means to regularly integrate new security technologies and best practices and ensure QK is always at the cutting edge of corporate security thereby creating an environment that protects people, products, services and the company.
Detailed Job Description
- The Risk Management & Compliance Head is responsible for establishing and maintaining a corporate wide information security management program to ensure that information assets are adequately protected. This position is responsible for identifying, evaluating and reporting on information security risks in a manner that meets compliance and regulatory requirements, and aligns with and supports the risk posture of the enterprise.
- The Risk Management & Compliance Head position requires a visionary leader with sound knowledge of information security technologies and a working knowledge of business management. The Risk Management & Compliance Head will proactively work with business units to implement practices that meet defined policies and standards for information security. He or she will also oversee a variety of IT-related risk management activities.
- The Risk Management & Compliance Head serves as the process owner of all assurance activities related to the availability, integrity and confidentiality of customer, business partner, employee and business information in compliance with the organization's information security policies.
- A key element of the Risk Management & Compliance Head's role is working with executive management to determine acceptable levels of risk for the organization. The Risk Management & Compliance Head must be highly knowledgeable about the business environment and ensure that information systems are maintained in a fully functional, secure mode.
- The Risk Management & Compliance Heads role is to act as an interface between the Management's strategic and process-based activities and the work of the technology-focused analysts, engineers and administrators in the IT organization. He must be able to translate the IT-risk requirements and constraints of the business into technical control requirements and specifications, as well as report on ongoing performance. He coordinates the IT organization's technical activities to implement and manage security infrastructure, and to provide regular status and service-level reports to management.
- The ideal candidate is a thought leader, a consensus builder, and an integrator of people and processes. While the Risk Management & Compliance Head is the leader of the security program, he or she must also be able to coordinate disparate drivers, constraints and personalities, while maintaining objectivity and a strong understanding that security is just one of the business's activities. It cannot be undertaken at the expense of the enterprise's ability to deliver on its goals and objectives.
- Expertise in leading project teams and developing and managing projects is essential for success in this role. The Risk Management & Compliance Head must be able to prioritize work efforts balancing operational tasks with longer-term strategic security efforts. Other project management tasks will include resource balancing across multiple IT and security teams, task prioritizing and project reporting. Vendor relationship management ensuring that service levels and vendor obligations are met is also an important aspect of the position.
- Risk Management & Compliance Head is responsible for managing highly technical staff as they work to accomplish company and personal development goals and must, therefore, have proven leadership skills. Documentation and presentation skills, analytical and critical thinking skills, and the ability to identify needs and take initiative are key requirements of this position.
Roles and Responsibilities
The Risk Management & Compliance Heads job is composed of a variety of activities, including tactical, operational and strategic activities:
A. Strategic Support and Management:
- Develop, implement and monitor a strategic, comprehensive enterprise information security and IT risk management program to ensure that the integrity, confidentiality and availability of information is owned, controlled or processed by the organization.
- Manage the enterprise's information security organization, consisting of direct reports and indirect reports (such as individuals in business continuity and IT operations). This includes hiring, training, staff development, performance management and annual performance reviews.
- Develop, maintain and publish up-to-date information security policies, standards and guidelines.
- Oversee the approval, training, and dissemination of security policies and practices.
- Create, communicate and implement a risk-based process for vendor risk management, including the assessment and treatment for risks that may result from partners, consultants and other service providers. Create and manage information security and risk management awareness training programs for all employees, contractors and approved system users.
- Work directly with the business units to facilitate IT risk assessment and risk management processes, and work with stakeholders throughout the enterprise on identifying acceptable levels of residual risk.
- Provide regular reporting on the current status of the information security program to enterprise risk teams, senior business leaders and the board of directors as part of a strategic enterprise risk management program.
- Create a framework for roles and responsibilities with regard to information ownership, classification, accountability and protection.
- Provide strategic risk guidance for IT projects, including the evaluation and recommendation of technical controls. Coordinate information security risk management projects with resources from the IT organization and business unit teams. Ensure that security programs comply with relevant laws, regulations and policies to minimize or eliminate risk and audit findings. Define and facilitate the information security risk assessment process, including the reporting and oversight of treatment efforts to address negative findings.
- Manage security incidents and events to protect corporate IT assets, including intellectual property, regulated data and the company's reputation.
- Work as a liaison with vendors and the legal and purchasing departments to establish mutually acceptable contracts and service-level agreements.
- Monitor the external threat environment for emerging threats and advise relevant stakeholders on the appropriate courses of action.
- Develop and oversee effective Disaster Recovery, BCP and WFH policies and standards to align with enterprise business continuity management program goals. Coordinate the development of implementation plans and procedures to ensure that business-critical services are recovered in the event of a security event. Provide direction, support and in-house consulting in these areas.
- Facilitate a metrics and reporting framework to measure the efficiency and effectiveness of the program, facilitate appropriate resource allocation, and increase the maturity of the security. Understand and interact with related disciplines through committees to ensure the consistent application of policies and standards across all technology projects, systems and services, including, but not limited to, privacy, risk management, compliance and business continuity management.
B. Security Liaison:
- Liaise among the information security team and corporate compliance, audit, legal and HR management teams as required.
- Liaise with external agencies, such as law enforcement and other advisory bodies as necessary, to ensure that the organization maintains a strong security posture.
- Assist resource owners and IT staff in understanding and responding to security audit failures reported by auditors.
- Manage security issues and incidents and participate in problem and change management forums. Ensuring timely reporting and adequate participation in investigation for ICT security incidents with customers, regulatory agencies and law enforcement agencies as applicable.
- Work with various stakeholders to identify information asset owners to classify data and systems as part of a control framework implementation. Work with the IT and business stakeholders to define metrics and reporting strategies that effectively communicate successes and progress of the security program.
C. Architecture/Product Engineering Support
- Consult with IT and security staff to ensure that security is factored into the evaluation, selection, installation and configuration of hardware, applications and software. Recommend and coordinate the implementation of technical controls to support and enforce defined security policies.
- Research, evaluate, design, test, recommend or plan the implementation of new or updated information security hardware or software, and analyse its impact on the existing environment; provide technical and managerial expertise for the administration of security tools.
- Work with the enterprise architecture team to ensure that there is a convergence of business, technical and security requirements; liaise with IT management to align existing technical installed base and skills with future architectural requirements.
- Design, coordinate and oversee security-testing procedures to verify the security of systems, networks and applications, and manage the remediation of identified risks.
- Develop a strong working relationship with the security engineering team to develop and implement controls and configurations aligned with security policies and legal, regulatory and audit requirements.
D. Operational Support
- Coordinate measure and report on the technical aspects of security management.
- Manage outsourced vendors that provide information security functions for compliance with contracted service-level agreements. Manage and coordinate operational components of incident management, including detection, response and reporting.
- Maintain a knowledgebase comprising a technical reference library, security advisories and alerts, information on security trends and practices, and laws and regulations.
- Manage the day-to-day activities of threat and vulnerability management, identify risk tolerances, recommend treatment plans and communicate information about residual risk.
- Ensure audit trails, system logs and other monitoring data sources are reviewed periodically and comply with policies and audit requirements.
Experience and Qualifications
- A minimum of 14 16 years of Information Security experience, with min 8 years in a leadership role having demonstrated end to end responsibility of the overall Risk Management & Compliance (Infosec) program. Banking experience is strongly preferred and will have more weightage.
- Knowledge and understanding of relevant legal and regulatory requirements, ISO 27001, ISO 17025, ISO 9001, SOC2, ISO 27701, DPDP, GDPR etc
- A bachelor's degree in information systems or equivalent work experience; a BSc in IT with specialization in information security is preferred.
- Certifications from [list detailed below:
- Experience with common information security management frameworks, such as International Standards Organization (ISO) 2700x, the IT Infrastructure Library (ITIL) and Control Objectives for Information and Related Technology (COBIT) frameworks etc
- Strong leadership skills and the ability to interact with and build strong relationships at all levels and across all business units and organizations and understand business imperatives.
- Exhibit excellent analytical skills to analyse security requirements and relate them to appropriate security controls. A strong understanding of the business impact of security tools, technologies and policies.
- Excellent verbal, written and interpersonal communication and program management skills, including the ability to communicate effectively with the IT organization, project and application development teams, management and business personnel; in-depth knowledge and understanding of information risk concepts and principles as a means of relating business needs to security controls; an excellent understanding of information security concepts, protocols, industry best practices and strategies.
- Experience working with legal, audit and compliance staff. Proficiency in performing risk, business impact, control and vulnerability assessments, and in defining treatment strategies.
- Experience in system technology security testing (vulnerability scanning and penetration testing).
- Familiarity in application technology security testing (white box, black box and code review) Certifications
Role specific certifications (Atleast two or more preferred):
- Certified Information Systems Security Professional (CISSP)
- Certified Information Systems Auditor (CISA)
- Certified Information Security Manager (CISM)
- ISO 27001: 2013 Lead Auditor / Implementer
- ISO 9001:2015 - Quality management systems
- ISO/IEC 17025 - Competence of testing and calibration laboratories
- ISO 22301 - Business Continuity Standard
- ISO 27701 PIMS Lead Auditor
- SOC2 / DPDP / GDPR related certification
Vendor specific certifications (Atleast any two preferred):
- IT / Other certification ITIL Practitioner Prince 2 / PMP (optional)
Job Classification
Industry: IT Services & ConsultingFunctional Area / Department: IT & Information SecurityRole Category: IT SecurityRole: Head - Information SecurityEmployement Type: Full timeContact Details:
Company: QualitykioskLocation(s): Mumbai+ View Contact
Keyskills: IT Risk Management GRC IT Governance Risk Compliance
Fraud Alert to job seekers!
₹ Not Disclosed
Similar positions
Job Listings
We are in open beta version of website, please let us know if any issues, at: info(at)indigojobs.in