ZS Associates - IT Risk Governance Specialist - GRC (7-10 yrs)
ZS is the world's largest consulting firm focused exclusively on helping companies improve overall performance and grow revenue and market share, through end-to-end sales and marketing solutions - from customer insights and strategy to analytics, operations and technology. From our worldwide offices, ZS experts draw on deep industry and domain expertise to help companies make smarter decisions quickly and cost effectively. We are particularly known for our strong presence in the pharmaceutical and health care sectors, yet work across a range of industries.
ZS's Corporate Support teams operate the firm's core internal enterprise functions. Our global teams comprise team-oriented, pragmatic and results-driven people who thrive in a challenging work environment. Our people come from diverse backgrounds, but share a passion for quality customer service and dedication - whether our customer is a client or another ZS employee.
Information Technology provides products and services to ZS to ensure successful business outcomes. IT provides internal information technology solutions and support for ZS, including custom enterprise Web and ERP applications, IT infrastructure and technology support.
RISK GOVERNANCE SPECIALIST
- We are currently seeking applicants for the position of a IT Risk Governance Specialist to join our India IT Governance, Compliance and Audit team.
- The position will support various management directed, IT risk governance initiatives which include reviewing findings from vulnerability assessments, driving remediation of vulnerabilities, proactively identifying process and technical gaps which may result in potential audit issues, verifying that remediation plans are implemented and tracked through completion, preparing reports for senior leadership consumption, assisting with risk reporting activities to ZS's risk committees, creating and maintaining security risk scorecards based on risk and threat levels assigned to ZS managed assets and user populations, and preparing reports for internal and external stakeholder consumption.
- Qualified candidates will possess the skills detailed below and relevant work experience.
Please note, this position is not client facing and does not require travel to client sites, unless specifically directed by management. This position may require travel to other ZS offices to assist with governance related activities and internal audits, as directed.
- Assist in maturing the first line of defense function across IT by establishing requirements for monitoring IT controls across the organization;
- Develop a process, risk, control framework with IT to map organizational controls and establish the accountability and ownership for IT risk management and control activities;
- Track and verify adherence to information security polices procedures and requirements;
- Analyze findings from security monitoring systems. Review all current and existing vulnerabilities for active and acceptable remediation plans;
- Prepare findings reports for review by various stakeholders which may include application owners, data owners and custodians, system administrators, other IT and business unit leadership and company level risk and audit committees;
- Verify that remediation plans are implemented per remediation plan. Proactively review and identify any potential gaps that may result in possible audit issues;
- Review vulnerability scan results to identify security risks and report on findings to appropriate stakeholders;
- Create and manage security risk scorecards based on risk levels assigned to ZS managed assets and personnel with access to sensitive information (e.g. in accordance with a data classification matrix);
- Assist compliance and audit team members with the preparation of detailed plans for performing individual audits including identification of key risks and controls, determination of audit objectives, and input toward the development and maintenance of an appropriate internal audit program;
- Provide input to risk assessment processes for key enterprise and client facing systems;
- Incorporate feedback received from risk assessment processes, and internal and external audits to adjust and fine tune technology risk governance processes;
- Demonstrate and apply a thorough understanding of complex information systems. Use knowledge of the current IT environment and industry IT trends to help with the identification of potential issues and risks;
- Liaise with internal and external stakeholders to ensure IT compliance related documentation is kept up to date with ZS's compliance requirements, obligations and commitments, as needs evolve;
- Liaise with appropriate stakeholders including IT, Legal, HR, Finance and others, as needed, to ensure that evolving compliance requirements are incorporated into risk governance processes;
- Manage GRC tools lifecycle including tool configuration needs with appropriate internal and external stakeholders;
- Assist with the development of appropriate IT compliance training material and conduct training of impacted stakeholders, as needed;
- Assist with other technology risk governance related initiatives and special projects as assigned from time to time.
- BS/BA in Management Information Systems (MIS), computer science or related field with record of high academic achievement required;
- 7+ years of experience in risk management and technology compliance disciplines: audits, regulatory compliance, risk management, program management and change management within the security governance and risk management space, required;
- 3+ years of experience supervising IT audit engagement lifecycles (e.g. US SOX, US SOC1 & SOC2 audits) ISO 27001 audits, with very minimal oversight. Lifecycle includes the planning, execution, communication, and reporting phases of an audit engagement;
- 2+ years- experience building and managing a team of junior staff and consultants, required
- Experience in identification and remediation of security threats and risks;
- Experience maintaining risk and control registers, audit plans, findings and remediation recommendation registers;
- Experience with use of collaboration tools (e.g. SharePoint Online or other GRC like tools) for reporting purposes is strongly preferred;
- Detailed knowledge of how operational controls are implemented to meet compliance needs;
- Skilled at preparing and presenting compliance and risks reporting at all levels of the company, from operational efforts through executive level presentation;
- Broad understanding of information security policies and standards, and regulatory/framework compliance;
- Strong communication skills, interpersonal skills, and presentation skills that allow effective interactions/communications with executives, business partners across regional and/or functional lines including the cascade of knowledge to the operating level;
- Superior command over the English language, verbal and written; experience writing management and auditor level narratives and reports required;
- Corporate or consulting firm risk management and governance experience required. Big 4 IT assurance/public accounting firm experience, while not required, is strongly preferred;
- Experience with reviewing the work of others (e.g. junior staff) highly preferred;
- Excellent communication and organizational skills - preferably with international exposure;
- Demonstrated ability to work independently and as part of cross office teams (e.g. US, India);
- Ability and willingness to work hours which overlap with International time zones (e.g. US time zone);
- Ability and willingness to travel to other ZS offices, as needed, to assist with compliance and audit engagements;
- Certified or eagerness to become certified in IT audit/risk governance related certifications while working at ZS (e.g. CGEIT, CRISC, ISO27001 Lead Auditor).
Technical expectations include:
- Basic working knowledge of web based applications, operating systems and databases including Windows Active Directory, Linux, Microsoft SQL and Oracle;
- Proficient in MS Office productivity suite (e.g. Word, Excel, PowerPoint, Access, SharePoint). Advanced Excel Access database skills strongly preferred;
- Working knowledge of GRC tools; experience working with a industry recognized GRC tool highly preferred
Working knowledge of various control frameworks includin:
- COBIT - Control Objectives for Information and Related Technology
- ISO/IEC 27001:2013 - Code of Practice for Information Security Management
- NIST SP 800-53
- NIST CSF
- HIPAA/HITECH Security and Privacy Audit Protocol
Shared Assessments Standard Information Gathering (SIG) framework
- Basic working knowledge of various laws directly or indirectly impacting data security and privacy requirements worldwide including:
- US SOX - Sarbanes Oxley Act
- US HIPAA/HITECH Act
- EU GDPR - General Data Protection Regulation
- US EU Privacy Shield
- India IT Act (data privacy provisions)
- India Companies Act