Techno Functional Consultant

About this role

• Minimum five years Information Security/ IT Security experience, evidenced by a professional qualification, such as, CISSP, CISM, CRISC, CCSP, SANS GIAC, Cloud technologies/Azure/AWS/GCP, etc.
• Strong written and oral communication skills
• Strong networking and negotiating skills
• Ability to work with specialist technical and security experts and with senior business management.
  
  

• Working experience of control assurance and risk assessment of vendors or 3rd party suppliers, including both cloud and non-cloud.
• Good technical knowledge of IT systems, including, operating systems, databases, networking solutions, security tools, applications and application frameworks. Exposure to Cloud service such as Azure, Google and AWS is preferred.
• Strong process and technical knowledge of the application of IT Security tools and techniques.
• Knowledge of current and emerging information security vulnerabilities and mitigations ranging across the technologies required for securing data centres, global networks and third-party access to applications and resources.
• Demonstrable experience of performing technical risk analysis using structured risk assessment methodologies and tools, e.g. ISF IRAM, Mehari, Octave, SP800-30, CRAMM etc.
• Working knowledge of ISO 27001, SOC2, ISAE, CSA Cloud Control Framwork, CoBIT, Risk IT , the Data Protection Act and PCI DSS, etc.
• Exposure to Governance, Risk and Compliance tools such as Archer, ServiceNow, Open pages, etc.
  
  

• Provide SME support to review vendor (cloud and non-cloud) information security controls based on the Bank-identified cloud controls framework (Ex. CSA ? CCM& CAIQ). The controls review may include site visits and review of physical controls
• Review of vendor independent audit reports (SOC/ISAE/PCI DSS) and security/penetration test results to understand the threat agents, the technical vulnerabilities and how the threat agents could exploit the vulnerabilities to realise the risk.
• Conduct IT controls testing of Cloud controls of internal Cloud Control Framework
• Responsible for incorporating output from controls review into an internal Cloud Risk Assessment document template and rate impact and probability of occurrence to arrive at overall risk ratings
• Support projects to present risk assessment output to appropriate governance forums and committees to secure approval
• Act as a process and governance expert for the Cloud Risk assessment process for the Bank?s projects and programmes
• Participate from time to time in supplier selection process, evaluating usefulness and cost of products and making appropriate recommendation.
• Manage key business stakeholders to secure strong stakeholder engagement and buy-in for a solution.
• Own and resolve complex security enquiries and problems