Tata AIA Life Insurance - Senior Manager - IT Risk

Department : Risk Management office

Level/ Band : 501

Reports To : Chief Risk Officer

Supervises : NA

Geographic Area Covered : PAN India

Stakeholders - Internal : Departments

Stakeholders - External : Department

Key Result Areas :

Specialist in IT Risk Management :

- 2nd line inputs into the risk identification and management process across all aspects of IT

- Stay knowledgeable of current advances in all areas of IT concerning vulnerabilities, security breaches or malicious attacks;

- Assesses adequacy of the security strategy, BCP /disaster recovery plans, threats to the systems, calculate the impact of potential adverse events, continuously updating, as the threat profiles change constantly.

- Keep management up to date on the results of the risk assessment and make recommendations for mitigations, or projects, to protect their systems or cover potential losses

- Continually improve the quality of the risk management, collect lessons learned information and metrics from security events and integrate the knowledge gathered into future protection strategies. [E.g. reviewing logs, network traces and other evidence from computers, networks and data storage devices].

- Recommend improvements in network security, identity management and logging

- Examine systems and procedures: identify potential adverse events, including hardware, software crashes, physical disasters, malicious intruders, malware, denial of service attacks and employee misconduct.

- Analysis will include a clear description of the risk and its likelihood. For those considered significant, an assessment of the impact in rupees or business disruption will be developed. From this, mitigation plans must be developed and presented to management for approval and funding.

- Identify defensive steps to take, including necessary firewalls, security software and data encryption;

- Recommend all infrastructure and applications patching and remediation be done;

- Assist in the coordination and preparation of presentation material for Risk Committees

Skills Required :

Technical :

- A comprehensive knowledge of hardware /software/ network architecture and domains in IT operations with a focus on governance, risk and compliance;

- Understanding of vulnerabilities across the IT landscape;

- Knowledge of personal computer, tablets, Tablets and mobile architectures, OS and applications;

- Experience in conducting / facilitating IT audits - ISO 27001

- Project management skills, with risk management;

- Fluency in LANs, WAN, VPNs, Routers, firewalls, and IDS/IPS systems;

- Relevant information security certifications (e.g., CISSP, CISA, CISM, CRISC, or GIAC) or the ability to gain a certification after hiring;

- Understanding of legal, Statutory and regulatory compliance standards and requirements against customer data including Payment Card Industry Data Security Standard (PCIDSS), ISO27001, NIST and COBIT;

- Ability to evaluate technology policies and standards, technical engineering standards and operational procedures;

- Knowledge of products which protect systems, such as Intrusion Prevention Systems (host- and network-based), Firewalls, Security Event Management Systems, port scanning and vulnerability identification, monitoring and logging mechanisms, etc;

- Familiarity with multiple software types at the application and enterprise levels;

- Up to date operational knowledge of computer security, Anti virus, malware and hacking attacks;

- Financial and business training to develop risk impact values and mitigation cost cases; and

- Integrated Information Technology Security strategies

- Ability to understand large, complex systems;

- Analytical ability to focus on specific details or subsystems, their vulnerabilities and linkages;

- An inquisitive, or problem-solving, mindset;

- Strong financial analysis, communication & organizational skills;

- Good written and oral communication;

Incumbent Characteristics :

Qualification : BE

Experience : 6 years experience. Experience with IT audits

Certifications : CISA /CISM