ZS Associates Looking for Governance & Risk Specialist/IT (Pune, India) at Pune, Maharashtra Full Time

ZS is a professional services firm that works side by side with companies to help develop and deliver products that drive customer value and company results. From R&D to portfolio strategy, customer insights, marketing and sales strategy, operations and technology, we leverage our deep industry expertise and leading-edge analytics to create solutions that work in the real world. Our most valuable asset is our people—a fact that’s reflected in our values-driven organization in which new perspectives are integral and new ideas are celebrated. ZSers are passionately committed to helping companies and their customers thrive in industries ranging from healthcare and life sciences, to high-tech, financial services, travel and transportation, and beyond.

ZS’s India Capability & Expertise Center (CEC) houses more than 60% of ZS people across three offices in New Delhi, Pune and Bengaluru. Our teams work with colleagues across North America, Europe and East Asia to create and deliver real world solutions to the clients who drive our business. The CEC maintains standards of analytical, operational and technological excellence across our capability groups. Together, our collective knowledge enables each ZS team to deliver superior results to our clients.

:

ZS’s Corporate Enterprise Functions operate the firm’s core internal functions. Our global teams comprise team-oriented, pragmatic and results-driven people who thrive in a challenging work environment. Our people come from diverse backgrounds but share a passion for quality customer service and dedication—whether our customer is a client or another ZS employee.

Information Technology provides products and services to ZS to ensure successful business outcomes. IT provides internal information technology solutions and support for ZS, including custom enterprise Web and ERP applications, IT infrastructure and technology support.

RISK GOVERNANCE SPECIALIST

We are currently seeking applicants for the position of a IT Risk Governance Specialist to join our India IT Governance, Compliance and Audit team. The position will support various management directed, IT risk governance initiatives which include reviewing findings from vulnerability assessments, driving remediation of vulnerabilities, proactively identifying process and technical gaps which may result in potential audit issues, verifying that remediation plans are implemented and tracked through completion, preparing reports for senior leadership consumption, assisting with risk reporting activities to ZS’s risk committees, creating and maintaining security risk scorecards based on risk and threat levels assigned to ZS managed assets and user populations, and preparing reports for internal and external stakeholder consumption. Qualified candidates will possess the skills detailed below and relevant work experience. Please note, this position is not client facing and does not require travel to client sites, unless specifically directed by management. This position may require travel to other ZS offices to assist with governance related activities and internal audits, as directed.

Responsibilities:
Assist in maturing the first line of defense function across IT by establishing requirements for monitoring IT controls across the organization;

Develop a process, risk, control framework with IT to map organizational controls and establish the accountability and ownership for IT risk management and control activities;

Track and verify adherence to information security polices procedures and requirements;

Analyze findings from security monitoring systems. Review all current and existing vulnerabilities for active and acceptable remediation plans;

Prepare findings reports for review by various stakeholders which may include application owners, data owners and custodians, system administrators, other IT and business unit leadership and company level risk and audit committees;

Verify that remediation plans are implemented per remediation plan. Proactively review and identify any potential gaps that may result in possible audit issues;

Review vulnerability scan results to identify security risks and report on findings to appropriate stakeholders;

Create and manage security risk scorecards based on risk levels assigned to ZS managed assets and personnel with access to sensitive information (e.g. in accordance with a data classification matrix);

Assist compliance and audit team members with the preparation of detailed plans for performing individual audits including identification of key risks and controls, determination of audit objectives, and input toward the development and maintenance of an appropriate internal audit program;

Provide input to risk assessment processes for key enterprise and client facing systems;

Incorporate feedback received from risk assessment processes, and internal and external audits to adjust and fine tune technology risk governance processes;

Demonstrate and apply a thorough understanding of complex information systems. Use knowledge of the current IT environment and industry IT trends to help with the identification of potential issues and risks;

Liaise with internal and external stakeholders to ensure IT compliance related documentation is kept up to date with ZS’s compliance requirements, obligations and commitments, as needs evolve;

Liaise with appropriate stakeholders including IT, Legal, HR, Finance and others, as needed, to ensure that evolving compliance requirements are incorporated into risk governance processes;

Manage GRC tools lifecycle including tool configuration needs with appropriate internal and external stakeholders;

Assist with the development of appropriate IT compliance training material and conduct training of impacted stakeholders, as needed;

Assist with other technology risk governance related initiatives and special projects as assigned from time to time.

Qualifications:
BS/BA in Management Information Systems (MIS), computer science or related field with record of high academic achievement required;

7+ years of experience in risk management and technology compliance disciplines: audits, regulatory compliance, risk management, program management and change management within the security governance and risk management space, required;

3+ years of experience supervising IT audit engagement lifecycles (e.g. US SOX, US SOC1 & SOC2 audits) ISO 27001 audits, with very minimal oversight. Lifecycle includes the planning, execution, communication, and reporting phases of an audit engagement;

2+ years’ experience building and managing a team of junior staff and consultants, required

Experience in identification and remediation of security threats and risks;

Experience maintaining risk and control registers, audit plans, findings and remediation recommendation registers;

Experience with use of collaboration tools (e.g. SharePoint Online or other GRC like tools) for reporting purposes is strongly preferred;

Detailed knowledge of how operational controls are implemented to meet compliance needs;

Skilled at preparing and presenting compliance and risks reporting at all levels of the company, from operational efforts through executive level presentation;

Broad understanding of information security policies and standards, and regulatory/framework compliance;

Strong communication skills, interpersonal skills, and presentation skills that allow effective interactions/communications with executives, business partners across regional and/or functional lines including the cascade of knowledge to the operating level;

Superior command over the English language, verbal and written; experience writing management and auditor level narratives and reports required;

Corporate or consulting firm risk management and governance experience required. Big 4 IT assurance/public accounting firm experience, while not required, is strongly preferred;

Experience with reviewing the work of others (e.g. junior staff) highly preferred;

Excellent communication and organizational skills – preferably with international exposure;

Demonstrated ability to work independently and as part of cross office teams (e.g. US, India);

Ability and willingness to work hours which overlap with International time zones (e.g. US time zone);

Ability and willingness to travel to other ZS offices, as needed, to assist with compliance and audit engagements;

Certified or eagerness to become certified in IT audit/risk governance related certifications while working at ZS (e.g. CGEIT, CRISC, ISO27001 Lead Auditor).

Technical expectations include:
Basic working knowledge of web based applications, operating systems and databases including Windows Active Directory, Linux, Microsoft SQL and Oracle;

Proficient in MS Office productivity suite (e.g. Word, Excel, PowerPoint, Access, SharePoint). Advanced Excel Access database skills strongly preferred;

Working knowledge of GRC tools; experience working with a industry recognized GRC tool highly preferred

Working knowledge of various control frameworks including:
COBIT – Control Objectives for Information and Related Technology

ISO/IEC 27001:2013 – Code of Practice for Information Security Management

NIST SP 800-53

NIST CSF

HIPAA/HITECH Security and Privacy Audit Protocol

Shared Assessments Standard Information Gathering (SIG) framework

Basic working knowledge of various laws directly or indirectly impacting data security and privacy requirements worldwide including:

US SOX – Sarbanes Oxley Act

US HIPAA/HITECH Act

EU GDPR – General Data Protection Regulation

US EU Privacy Shield

India IT Act (data privacy provisions)

India Companies Act

:

ZS is a global consulting firm. Fluency in English is required; additional fluency in at least one European or Asian language is desirable.

Candidates must possess work authorization for their intended country of employment. An on-line application, including a full set of transcripts (official or unofficial), is required to be considered.

ZS offers a competitive compensation package with salary and bonus incentives, plus an attractive benefits package.

NO AGENCY CALLS, PLEASE.