Divisional Risk and Control Specialist, VP

Overview

Lead risk-based IT and Information Security assessments across the Corporate Bank Technology landscape as part of the Proactive Risk Testing Programme, independently assessing the design, implementation and operating effectiveness of key controls.

What you'll do

• Lead and deliver risk-based, end-to-end IT and Information Security assessments across the Corporate Bank (CB) Technology landscape, independently assessing the design, implementation and operating effectiveness of key controls.
• Develop an in-depth understanding of business services and their supporting technology, including application and platform architecture, infrastructure, databases, operating systems, cloud services, networks, interfaces, APIs, data flows, batch and real-time processing, and third-party dependencies.
• Perform technical deep dives across applications, platforms, databases and infrastructure to identify and assess existing and emerging IT and IS risks, control weaknesses, root causes, systemic themes and potential impacts on confidentiality, integrity, resilience and regulatory compliance.
• Assess technology lifecycle risks and controls including design, development and production, considering aspects such as access management, security, operations and resilience.
• Apply professional judgement to define risk-based testing scope, develop risk and control matrices, determine sampling and testing approaches, analyze technical evidence, and produce clear, well-supported conclusions in line with testing standards.
• Challenge technology and control owners constructively, communicate complex technical risks in business terms and support agreement on pragmatic and sustainable remediation actions.
• Identify cross-application and thematic risks, emerging technology threats, control automation opportunities and opportunities to use data analytics and continuous monitoring to improve assurance coverage.
• Partner with Technology Application Teams, Architects, Engineering, Information Security, Control Owners, the Divisional Control Office, Group Audit and other stakeholders to promote transparency and sustainable risk mitigation.
• Contribute to the ongoing enhancement of risk-based testing methodologies, standards, documentation and quality assurance, while providing guidance and technical coaching to colleagues where required.

What you'll need

• Extensive experience in IT/Cyber security assessments, technology risk, information security, controls assurance or a related discipline, including leading complex reviews in a large, regulated organization.
• In-depth understanding of enterprise technology and application architecture, including cloud and on-premises infrastructure, databases, operating systems, networks, APIs, middleware, data integration and third-party services.
• Demonstrable ability to analyze architecture diagrams, data flows, configurations, system logs, access models, vulnerability information and other technical evidence to identify control gaps and assess their business and risk impact.
• Strong knowledge of IT General Controls and Application Controls, cyber security, secure software development, identity and access management, privileged access management, network and cloud security, vulnerability management, data and cryptographic protection, security monitoring, incident management, operational resilience and technology lifecycle management.
• Experience applying recognized frameworks and standards such as COBIT, NIST, ISO 27001, ITIL and relevant regulatory expectations.
• Strong analytical and problem-solving capability, with the confidence to challenge senior stakeholders and translate complex technical matters into concise, risk-based findings and practical remediation actions.
• Excellent written and verbal communication, stakeholder management and influencing skills, with the ability to work independently, manage competing priorities and deliver high-quality outcomes.
• Proven ability to leverage AI tools to enhance productivity and optimise workflows to solve business problems, while applying critical judgment to ensure responsible and ethical use of data and AI outputs.

Nice to have

• Professional certifications such as CISA, CISSP, CRISC, or equivalent.
• Awareness of emerging technology and risk areas, including cloud security, DevSecOps, automation, artificial intelligence, open-source software, third-party concentration and evolving cyber threats.
• Experience working in Agile and DevOps environments.
• Knowledge of Google Cloud Platform (GCP) and its control environment.

Details

• Location: Pune, India.
• Reports locally to the India Corporate Bank Technology Control Testing Lead in Pune and functionally to the CB Technology Testing Lead based in London.