IT Operations and IT Governance

Introduction -

IT Governance Domain knowledge - IT Operations Domain experience. process teams , Change mngt, IT Ops, Risk teams, IT Processes, Change mngt, Incident Mngt, handling only.

IT processes review through understanding, Governance, Preparing controls and processes and what can go wrong

Preferably in Banking environment, Banking IT Governance

Companies we looking from – Banks, Ernst and Young, TCS, KPMG and Deloitte

Job Purpose

· Working closely with the Function Head- TMAC- Risk Management to secure information, create, and implement Risk strategies to minimize the variety of risks that could threaten the key information.

· To partner with the Business to continually assess and identify potential risks, evaluating these to ensure that they are appropriately mitigated through properly implemented policies, procedures, training, systems and controls.

Job Responsibilities(JR) :

Actionable

· Risk Management- FLOD
• Responsible for maintaining effective controls and for executing risk and control procedures on a day-to-day basis.
• Develop, establish, and implement policies and frameworks for IT risk management
• Independently review, challenge and support risk management activities
• Perform or monitor risk assessments, which comprise analyzing, identifying, describing, and quantifying risks that impact all business risks
• Promoting technology risk and operational risk awareness
• Staying current in technology specific risk management techniques, industry best practices and regulatory requirements as well as specific areas of Information Technology Risk
• In response to material risk events, whether internal or external, conduct independent deep dive reviews and assessments to determine root cause(s), assess control environment, escalate issues and identify/monitor remedial actions to mitigate against the risk of future losses.

· ICAAP reporting

· Define Technology Risk Framework (KRIs, Thresholds and Weightage) for IT

· Identify, monitor, maintain and continuously improve the control stack for technology risk including documentation of KRIs to ensure relevance and usefulness

· Quarterly assessment of Key Risk Indicators forming part of the ICAAP Framework (incl. Cloud ICAAP framework)

· ICAAP Data Collection, Review, Correction and Submission.

· Follow up with IT verticals to ensure that the committed mitigation action has been implemented and reporting of delays, if any, to management
• Pro-active problem management activity using trend analysis of incidents, introspecting IT infrastructure, thorough analysis of release testing etc.
• Conduct Problem review meetings with IT verticals and TMAC- Quality on a weekly basis to arrive at root cause and remediation plan and demonstrate visible results in terms of reduction of High Risk KRIs

· Non ICAAP reporting

· Oversee Non ICAAP reporting process which includes data Collection, Review, Correction and Submission and subsequent follow up.

· Identify, monitor, maintain and continuously improve the control stack for technology risk including documentation of KRIs to ensure relevance and usefulness

· Follow up with IT verticals to ensure that the committed mitigation action has been implemented and reporting of delays, if any, to management

· Problem management and root cause analysis

· Quality Improvement Plan in Technology Risk Management
• Work closely with Quality team on various Quality initiatives through a systematic PDCA continuous improvement model grounded on the following principles:
• Establish a culture of quality in Technology Risk Management
• Determine and prioritize potential areas for improvement
• Collect and analyze data
• Communicate results- demonstrate Quality improvement
• Commit to ongoing evaluation
• Disseminate learnings

· Risk & Control Self-Assessment

· Work with IT verticals and ITDRM in design and implementation of Risk and Control Self Assessment (RCSA) for key IT policies and procedures

· Define Process for RCSA and Control Testing.

· Review Self-Assessment and Control Testing Results.

· Introduce improvements or correction to Processes / Controls.

· Annual review and revision of RCSA for critical IT Process and Procedure

· Review of Self assessment report published by ORMG and work on actionable within permitted timeline

· Other responsibilities

· Working in relation and conformity with internal and external auditors and providing timely response and closure to Audit observations

· Building and maintaining strong and positive working relationships and effective means of communication with other risk associates, including the Enterprise Risk Management, Operational Risk Management etc.

· Automate ICAAP, Non-ICAAP, Risk Register and RCSA Process.

· Performing other duties as assigned

Educational Qualifications

Key Skills

ü Graduation/ Certification such as CISA/ CRMA or equivalent professional qualification in a relevant discipline i.e., Science, Engineering.

ü Advanced qualifications or accredited in Lean Six Sigma Black Belt, Agile, Scrum, PRINCE2, ITIL, TOGAF, BPR, BMP and/or other global industry standard methodologies, frameworks.

Core Competencies
• Risk Management
• Quality Management
• Process Improvements
• Performance Measurement System.
• KPI (Key Performance Indicators) Management.
• Process and Control Compliance.
• Training and Coaching.

Other skills
• Breadth and depth of knowledge and experience of IT Processes and Risks, related industry standards and GRC tools is desired.
• Background of working in 1st/ 2nd or 3rd line of defense is desired.

ü Strong interpersonal skills and the ability to develop effective trustworthy relationships with the IT department and business stakeholders

ü Excellent communication skills, both written and verbal to be able to articulate complex IT risks in simple business terms
• Excellent problem solving and self-management skills in order to tactically and analytically solve technical problems and successfully handle management information and metrics design, collection, analysis, reports, etc.
• Focus on process streamlining and bringing in efficiencies