Job Description
Job description
Business:Group Risk
Open positions: 1
Role Title: Resilience Risk Specialist, Cloud Resilience Risk SME
Global Career Band: 4
Location (Country/city)- Bangalore
The Opportunity:
Operational Resilience Risk (ORR) is the 2nd LoD function, part of Global Risk and independent from day-to-day operations of the 1st LoD (Technology, Cyber Security, etc), acting to ensure that operational resilience including cyber information security risk across the bank is appropriately managed.
The Cloud Security Risk Role drives risk management oversight of HSBC's use of information technology provided either by HSBC Technology function or third parties, focused on cloud adoption and provision. This role will closely interact with control owners and Technology teams in 1LoD, providing oversight and challenge as to the bank's secure use of cloud-related technologies against various internal and external information and cyber security threats, and whether plans to mitigate related risks are appropriately robust and sufficient.
The focus is on cloud and information security risk oversight for related people, process, and technology components.
This a technical role and requires and a combination of hands-on experience in Cloud Technology and Cyber security risk consultancy. Audience will include Technology and non-technical stakeholders.
What you'll do:
Principal Accountabilities: Key activities and decision making areas
Impact on the Business/Function
• Provide Technical SME oversight of the continuous monitoring for Cloud Platforms Risk and Controls. For example: challenge and validate the shared platform's controls design, operation, effectiveness rational, oversight of mandatory procedure and adherence to operating instructions, KCI definitions and execution, continuous monitoring plan and issue/action updates assess overall security operational readiness per platform.
• Provide Technical SME support for critical business cloud adoption including workloads (direct use of cloud on org. managed cloud platform indirect use on cloud SaaS workloads) by providing technical opinion on the workloads controls designs (sampling IAM roles permissions, configurations design/settings), and cloud risk assessment (threat modelling, pen testing) depth and quality prior to going live.
• Provide Technical security opinion to risk and control owners, to ensure effective policy compliance, help identify improvements, share best practices and response to issues and cloud incidents. For example, providing SME guidance on security baseline for native cloud products prior to adoption by IT Developers, monitoring and assessing deviation from cloud native products security patterns.
• Regularly and formally document and communicate information and cyber technology risk observations, and ensure risk management items are appropriately captured in Group's operational risk management systems (i.e. HELIOS).
• Offer SME support on the newly design cloud journey approval process, technical opinion on the adequacy of exit planning, metrics for measure risk aggregation in cloud and risk assessment methodology for cloud workload and platform.
• Offer opinion on the suitability of native Cloud security tooling vs 3rd party vendor security tooling e.g. containers scanning, federated IAM for control improvements
• Attend project steer-cos, workshops, provide independent reporting, packs and evidence for internal and external audit
• Coordination of activities across stakeholders
• Provide periodic view on 2LOD view of the cloud platform top security concerns, maturity, and operational readiness for non-technical stakeholders
Typical Targets and Measures
• Evidence of contribution to an improving control environment
• Feedback from stakeholders on quality and timeliness of specialist advice and guidance
• Evidence of challenge, intervention and escalation of significant control issues
• Internal/External events reviewed and insight shared with 1LoD on time to a quality standard.
Customers / Stakeholders
• Influence and provide direction to the 1LOD and ORR Business & Functions team to ensure they fulfil own roles and responsibilities and manage resilience risk according to the Group's frameworks and within stated appetite
• Build and maintain relationships with external partners, regulators, industry bodies and others to keep up to date with developments
• Manage relationships with wider ORR team.
Typical Targets and Measures
• Evidence of timely specialist guidance and support to Risk Stewards on the management of Cloud security risks
• Compliance with regulatory requirements
• Positive stakeholder feedback.
Leadership & Teamwork
• Challenge and influence to ensure Cloud security risk specialist advice and guidance is understood and followed
• Work in conjunction with ORR Business & Functions team and the wider RR Specialist team
• Support diversity and reflect the HSBC brand and organisational values.
Typical Targets and Measures
• Evidence of Cloud security risk specialist advice provided and incorporated
• Evidence of effective team work globally
• Positive 360-degree feedback.
Operational Effectiveness & Control
• Partner with ORR Business & Functions team and 1LOD to identify, measure, mitigate, monitor and report Cloud security risks
• Partner with ORR Business & Functions team regarding Implementation of country Internal Audit and ORR recommendations and directions for the improved use of the Risk Framework related to Cloud security risk.
Typical Targets and Measures
• Evidence of risk identified, measured and reported on to the 1LoD
• Evidence of audit outcomes and alignment to risk framework related to Cloud security risk
Major Challenges (The challenges inherent in the role that require a continual test of the role holder's abilities)
• Operating with influence and gravitas across all Lines of Defences within Global Businesses/Functions and Legal Entities within, in relation to the management and oversight of resilience risk
• Providing clear delineation between accountable activities under operational and resilience risk
• Maintaining a commercial understanding without compromising standards of internal control and organisational risk appetite in a growing and successful business.
Role context
• The role holder will maintain close working relationships with the wider ORR team, globally.
• HSBC serves the needs of retail, corporate and institutional clients delivering innovative and integrated financial solutions. The Risk function discharges oversight on the management and monitoring of financial and non-financial risk by the businesses and their support functions.
• The importance of non-financial risk and control has increased in recent years and is now the most influential subject for senior management, boards, and regulators. An organisation's ability for effective identification, measurement and mitigation of non-financial risk will have a significant impact on the achievement of strategic objectives.
• The role has influence over a wide group of stakeholders and employees across the organisation.
Management of Risk (Operational Risk / FIM requirements)
Responsible for ensuring awareness of the ORR risk impact associated with the role and must act in a manner that takes account of ORR risk considerations.
Observation of Internal Controls
You will adhere to and be able to demonstrate adherence to HSBC internal control standards. This is achieved by adherence to all relevant procedures, keeping appropriate records and, where appropriate, by the timely implementation of internal and external audit points, including issues raised by external regulators.
Role Dimensions
You will be required to:
• Work closely with all components of the ORR Team.
• Build effective relationship internal and external to ORR
• Enhance control understanding across HSBC's Products and Services
The responsibility for non-financial risk spans globally. You may also be responsible for local entity management for other team members outside of your direct reports, according to HSBC local entity management requirements.
Requirements
What you will need to succeed in the role:
• Strong level of business knowledge and Cloud security risk expertise
• Strong level of risk management knowledge and relevant experience
• Comprehensive knowledge of the internal control environment
• Academics: Graduate or Post Graduate in Computer Engineering or related field
• Overall experience of 14+ years
• Should have worked in banking &risk environment
Key Capabilities
• Information security and risk consultancy
• Programming / engineering / Architecture experience in GCP (min 2 years +)
• Automation scripting (using scripting languages such as Terraform, Ansible etc.) (min 2 years +)
• GCP Certifications, in particular security certifications e.g. GCP Certified Security engineers.
Desirable Skills
• Security and Technology Risk certification (CCSK or CCSP) and CRISC
• Technical knowledge (CSP's, IAM, OS, CI/CD and automation tools)
You'll achieve more at HSBC
HSBC is an equal opportunity employer committed to building a culture where all employees are valued, respected and opinions count. We take pride in providing a workplace that fosters continuous professional development, flexible working and, opportunities to grow within an inclusive and diverse environment. We encourage applications from all suitably qualified persons irrespective of, but not limited to, their gender or genetic information, ****** orientation, ethnicity, religion, social status, medical care leave requirements, political affiliation, people with disabilities, color, national origin, veteran status, etc., We consider all applications based on merit and suitability to the role.'
Personal data held by the Bank relating to employment applications will be used in accordance with our Privacy Statement, which is available on our website.
...Issued By HSBC Electronic Data Processing (India) Private LTD...
14.00-17.00 Years
Business:Group Risk
Open positions: 1
Role Title: Resilience Risk Specialist, Cloud Resilience Risk SME
Global Career Band: 4
Location (Country/city)- Bangalore
The Opportunity:
Operational Resilience Risk (ORR) is the 2nd LoD function, part of Global Risk and independent from day-to-day operations of the 1st LoD (Technology, Cyber Security, etc), acting to ensure that operational resilience including cyber information security risk across the bank is appropriately managed.
The Cloud Security Risk Role drives risk management oversight of HSBC's use of information technology provided either by HSBC Technology function or third parties, focused on cloud adoption and provision. This role will closely interact with control owners and Technology teams in 1LoD, providing oversight and challenge as to the bank's secure use of cloud-related technologies against various internal and external information and cyber security threats, and whether plans to mitigate related risks are appropriately robust and sufficient.
The focus is on cloud and information security risk oversight for related people, process, and technology components.
This a technical role and requires and a combination of hands-on experience in Cloud Technology and Cyber security risk consultancy. Audience will include Technology and non-technical stakeholders.
What you'll do:
Principal Accountabilities: Key activities and decision making areas
Impact on the Business/Function
• Provide Technical SME oversight of the continuous monitoring for Cloud Platforms Risk and Controls. For example: challenge and validate the shared platform's controls design, operation, effectiveness rational, oversight of mandatory procedure and adherence to operating instructions, KCI definitions and execution, continuous monitoring plan and issue/action updates assess overall security operational readiness per platform.
• Provide Technical SME support for critical business cloud adoption including workloads (direct use of cloud on org. managed cloud platform indirect use on cloud SaaS workloads) by providing technical opinion on the workloads controls designs (sampling IAM roles permissions, configurations design/settings), and cloud risk assessment (threat modelling, pen testing) depth and quality prior to going live.
• Provide Technical security opinion to risk and control owners, to ensure effective policy compliance, help identify improvements, share best practices and response to issues and cloud incidents. For example, providing SME guidance on security baseline for native cloud products prior to adoption by IT Developers, monitoring and assessing deviation from cloud native products security patterns.
• Regularly and formally document and communicate information and cyber technology risk observations, and ensure risk management items are appropriately captured in Group's operational risk management systems (i.e. HELIOS).
• Offer SME support on the newly design cloud journey approval process, technical opinion on the adequacy of exit planning, metrics for measure risk aggregation in cloud and risk assessment methodology for cloud workload and platform.
• Offer opinion on the suitability of native Cloud security tooling vs 3rd party vendor security tooling e.g. containers scanning, federated IAM for control improvements
• Attend project steer-cos, workshops, provide independent reporting, packs and evidence for internal and external audit
• Coordination of activities across stakeholders
• Provide periodic view on 2LOD view of the cloud platform top security concerns, maturity, and operational readiness for non-technical stakeholders
Typical Targets and Measures
• Evidence of contribution to an improving control environment
• Feedback from stakeholders on quality and timeliness of specialist advice and guidance
• Evidence of challenge, intervention and escalation of significant control issues
• Internal/External events reviewed and insight shared with 1LoD on time to a quality standard.
Customers / Stakeholders
• Influence and provide direction to the 1LOD and ORR Business & Functions team to ensure they fulfil own roles and responsibilities and manage resilience risk according to the Group's frameworks and within stated appetite
• Build and maintain relationships with external partners, regulators, industry bodies and others to keep up to date with developments
• Manage relationships with wider ORR team.
Typical Targets and Measures
• Evidence of timely specialist guidance and support to Risk Stewards on the management of Cloud security risks
• Compliance with regulatory requirements
• Positive stakeholder feedback.
Leadership & Teamwork
• Challenge and influence to ensure Cloud security risk specialist advice and guidance is understood and followed
• Work in conjunction with ORR Business & Functions team and the wider RR Specialist team
• Support diversity and reflect the HSBC brand and organisational values.
Typical Targets and Measures
• Evidence of Cloud security risk specialist advice provided and incorporated
• Evidence of effective team work globally
• Positive 360-degree feedback.
Operational Effectiveness & Control
• Partner with ORR Business & Functions team and 1LOD to identify, measure, mitigate, monitor and report Cloud security risks
• Partner with ORR Business & Functions team regarding Implementation of country Internal Audit and ORR recommendations and directions for the improved use of the Risk Framework related to Cloud security risk.
Typical Targets and Measures
• Evidence of risk identified, measured and reported on to the 1LoD
• Evidence of audit outcomes and alignment to risk framework related to Cloud security risk
Major Challenges (The challenges inherent in the role that require a continual test of the role holder's abilities)
• Operating with influence and gravitas across all Lines of Defences within Global Businesses/Functions and Legal Entities within, in relation to the management and oversight of resilience risk
• Providing clear delineation between accountable activities under operational and resilience risk
• Maintaining a commercial understanding without compromising standards of internal control and organisational risk appetite in a growing and successful business.
Role context
• The role holder will maintain close working relationships with the wider ORR team, globally.
• HSBC serves the needs of retail, corporate and institutional clients delivering innovative and integrated financial solutions. The Risk function discharges oversight on the management and monitoring of financial and non-financial risk by the businesses and their support functions.
• The importance of non-financial risk and control has increased in recent years and is now the most influential subject for senior management, boards, and regulators. An organisation's ability for effective identification, measurement and mitigation of non-financial risk will have a significant impact on the achievement of strategic objectives.
• The role has influence over a wide group of stakeholders and employees across the organisation.
Management of Risk (Operational Risk / FIM requirements)
Responsible for ensuring awareness of the ORR risk impact associated with the role and must act in a manner that takes account of ORR risk considerations.
Observation of Internal Controls
You will adhere to and be able to demonstrate adherence to HSBC internal control standards. This is achieved by adherence to all relevant procedures, keeping appropriate records and, where appropriate, by the timely implementation of internal and external audit points, including issues raised by external regulators.
Role Dimensions
You will be required to:
• Work closely with all components of the ORR Team.
• Build effective relationship internal and external to ORR
• Enhance control understanding across HSBC's Products and Services
The responsibility for non-financial risk spans globally. You may also be responsible for local entity management for other team members outside of your direct reports, according to HSBC local entity management requirements.
Requirements
What you will need to succeed in the role:
• Strong level of business knowledge and Cloud security risk expertise
• Strong level of risk management knowledge and relevant experience
• Comprehensive knowledge of the internal control environment
• Academics: Graduate or Post Graduate in Computer Engineering or related field
• Overall experience of 14+ years
• Should have worked in banking &risk environment
Key Capabilities
• Information security and risk consultancy
• Programming / engineering / Architecture experience in GCP (min 2 years +)
• Automation scripting (using scripting languages such as Terraform, Ansible etc.) (min 2 years +)
• GCP Certifications, in particular security certifications e.g. GCP Certified Security engineers.
Desirable Skills
• Security and Technology Risk certification (CCSK or CCSP) and CRISC
• Technical knowledge (CSP's, IAM, OS, CI/CD and automation tools)
You'll achieve more at HSBC
HSBC is an equal opportunity employer committed to building a culture where all employees are valued, respected and opinions count. We take pride in providing a workplace that fosters continuous professional development, flexible working and, opportunities to grow within an inclusive and diverse environment. We encourage applications from all suitably qualified persons irrespective of, but not limited to, their gender or genetic information, ****** orientation, ethnicity, religion, social status, medical care leave requirements, political affiliation, people with disabilities, color, national origin, veteran status, etc., We consider all applications based on merit and suitability to the role.'
Personal data held by the Bank relating to employment applications will be used in accordance with our Privacy Statement, which is available on our website.
...Issued By HSBC Electronic Data Processing (India) Private LTD...
14.00-17.00 Years
💡 Quick Summary
Seeking a career-building opportunity? The Resilience Risk Specialist| Cloud Resilience Risk SME GSC|s position is now open for candidates interested in the Bank Jobs sector. This role in Bengaluru offers a professional environment and growth potential.
Requirement Snapshot: Candidates should possess basic communication skills, a proactive attitude, and the ability to work in a team. Experience in Bank Jobs is a plus.
