Senior Specialist, Technology Risk Management

Overview

Senior Specialist in Business Technology Risk, advising technology leaders, business stakeholders and cybersecurity teams on technology risks across applications, infrastructure, cloud, AI solutions and third-party vendors.

What you'll do

• Conduct end-to-end technology risk assessments across applications, infrastructure, cloud platforms, data platforms, AI/ML solutions and third-party services.
• Evaluate inherent, residual and emerging risks associated with new technologies and business initiatives.
• Assess technology implementations against corporate security standards, risk management requirements and regulatory expectations.
• Facilitate risk identification workshops with business and technical stakeholders.
• Develop risk scenarios, risk statements, impact assessments and treatment recommendations.
• Lead technical due diligence reviews for vendors, suppliers, SaaS providers, managed service providers and cloud service providers.
• Assess security architecture, data flows, application designs, integrations and hosting environments of third-party solutions.
• Review SIG questionnaires, security assessments, penetration test reports, SOC reports, audit reports and vendor security documentation.
• Identify control gaps and determine appropriate risk ratings and treatment strategies.
• Advise business owners on vendor onboarding risks, compensating controls and residual risk acceptance considerations.
• Support ongoing monitoring of high-risk vendors and critical third-party relationships.
• Assess risks associated with enterprise applications, APIs, integrations, identity services, cloud-hosted workloads and business platforms.
• Evaluate application architecture against secure design and security engineering principles.
• Review authentication, authorization, session management, encryption, secrets management, logging, monitoring and resilience controls.
• Analyze technical findings from penetration tests, red team exercises, vulnerability assessments, architecture reviews, threat modeling engagements and cloud security assessments.
• Identify root causes and recommend practical remediation actions.
• Assess design and operating effectiveness of technology and cybersecurity controls, including preventive, detective, corrective and compensating controls.
• Validate effectiveness of Identity & Access Management, Privileged Access Management, endpoint security, vulnerability management, network security, logging and monitoring, data protection controls, disaster recovery and business resilience, and cloud security controls.
• Support control maturity assessments and continuous improvement initiatives.
• Maintain risk registers and document technology risks in accordance with enterprise risk management processes.
• Facilitate risk discussions with technology teams, security engineers, architects, auditors and leadership.
• Challenge assumptions and validate evidence supporting risk decisions.
• Ensure risks are accurately documented, quantified, escalated and tracked through resolution.
• Support risk acceptance and remediation approval processes.
• Translate complex technical findings into clear business risk language.
• Develop executive-level risk summaries, dashboards, briefings and presentations.
• Provide concise insights on risk trends, emerging threats, control effectiveness, high-risk vendors and strategic technology initiatives.
• Support CISO, senior leadership and risk committees with risk-informed recommendations and decision support.
• Monitor evolving threat landscapes, attacker techniques and emerging technology risks.
• Provide risk advisory for strategic transformation initiatives including cloud modernization, AI/Generative AI adoption, digital transformation programs, large-scale platform migrations, and mergers, acquisitions and integrations.
• Partner with architecture, engineering, compliance and cybersecurity teams to embed risk considerations early in the solution lifecycle.

What you'll need

• Bachelor's degree in Information Technology, Computer Science, Cybersecurity, Engineering or related discipline.
• 5+ years of experience in Technology Risk Management, Cybersecurity, IT Audit, Third-Party Risk Management, Security Architecture or related disciplines.
• Strong experience conducting technology and cybersecurity risk assessments.
• Experience assessing third-party vendors, cloud providers and supplier-hosted solutions.
• Strong understanding of enterprise applications and technology architectures.
• Demonstrated ability to identify control gaps and articulate business impacts.
• Experience developing risk treatment plans and remediation recommendations.
• Excellent written, verbal and presentation skills.
• Ability to communicate effectively with both technical teams and executive leadership.
• Working knowledge of application security (Secure SDLC, OWASP Top 10, API security, authentication and authorization, secrets management, data protection, threat modeling).
• Working knowledge of cloud security (AWS, Azure, SaaS security, cloud security posture management, identity and federation, container and Kubernetes security).
• Working knowledge of infrastructure security (operating systems, Active Directory, network architecture and segmentation, endpoint security, vulnerability management).
• Working knowledge of risk and governance (IT risk assessments, control assessments, risk treatment planning, risk acceptance frameworks, risk registers, governance processes).

Nice to have

• Secondary skills: third-party risk, SIG framework, SOC reports, vendor security assessments, third-party due diligence, supply chain risk, vendor continuous monitoring.
• Professional certifications such as CISSP, CISM, CRISC, CISA, AWS Security Specialty or Azure Security Engineer.
• Experience in pharmaceutical, healthcare or regulated industries.
• Familiarity with AI/GenAI risk assessments.
• Experience supporting executive risk committees or CISO organizations.
• Experience with Archer, ServiceNow GRC, ARAVO, OneTrust or similar risk platforms.

Details

• Location: Hyderabad (Hitec City Raidurg), Telangana, India.
• Flexible work arrangement: Hybrid.
• No travel required.
• Visa sponsorship: No.
• Relocation: Domestic.
• Employee status: Regular.