Divisional Risk and Control Specialist, VP

Corporate Banking is a technology-driven business operating in an increasingly real-time, interconnected environment, where clients expect seamless services, integrated platforms and trusted access to data. Corporate Bank (CB) Technology supports this ambition through a complex global ecosystem of business-critical applications, platforms, data services and infrastructure. We are seeking an experienced technology risk professional to play a key role in our Proactive Risk Testing Programme, delivering rigorous, risk-based assessments across this landscape. The role requires the ability to develop a deep understanding of applications and their end-to-end architecture, critically evaluate the design and effectiveness of implemented technology controls, and identify both existing and emerging IT and Information Security risks. Working closely with senior technology, business and control stakeholders, you will translate complex technical observations into clear risk insights, strengthen the testing strategy and drive sustainable improvements that enhance the resilience, security and control environment of mission-critical technology services.

Role Description:

Reporting locally to the India Corporate Bank Technology Control Testing Lead in Pune and functionally to the CB Technology Testing Lead based in London, you will:

Your key responsibilities:

• Lead and deliver risk-based, end-to-end IT and Information Security assessments across the Corporate Bank (CB) Technology landscape, independently assessing the design, implementation and operating effectiveness of key controls.
• Develop an in-depth understanding of business services and their supporting technology, including application and platform architecture, infrastructure, databases, operating systems, cloud services, networks, interfaces, APIs, data flows, batch and real-time processing, and third-party dependencies.
• Perform technical deep dives across applications, platforms, databases and infrastructure to identify and assess existing and emerging IT and IS risks, control weaknesses, root causes, systemic themes and potential impacts on confidentiality, integrity, resilience and regulatory compliance.
• Assess technology lifecycle risks and controls including design, development and production considering aspects such as access management, security, operations and resilience.
• Apply professional judgement to define risk-based testing scope, develop risk and control matrices, determine sampling and testing approaches, analyze technical evidence, and produce clear, well-supported conclusions in line with testing standards.
• Challenge technology and control owners constructively, communicate complex technical risks in business terms and support agreement on pragmatic and sustainable remediation actions.
• Identify cross-application and thematic risks, emerging technology threats, control automation opportunities and opportunities to use data analytics and continuous monitoring to improve assurance coverage.
• Partner with Technology Application Teams, Architects, Engineering, Information Security, Control Owners, the Divisional Control Office, Group Audit and other stakeholders to promote transparency and sustainable risk mitigation.
• Contribute to the ongoing enhancement of risk-based testing methodologies, standards, documentation and quality assurance, while providing guidance and technical coaching to colleagues where required.

Your skills and experience:

• Extensive experience in IT/Cyber security assessments, technology risk, information security, controls assurance or related discipline, including leading complex reviews in a large, regulated organization.
• In-depth understanding of enterprise technology and application architecture, including cloud and on-premises infrastructure, databases, operating systems, networks, APIs, middleware, data integration and third-party services.
• Demonstrable ability to analyze architecture diagrams, data flows, configurations, system logs, access models, vulnerability information and other technical evidence to identify control gaps and assess their business and risk impact.
• Strong knowledge of IT General Controls and Application Controls, cyber security, secure software development, identity and access management, privileged access management, network and cloud security, vulnerability management, data and cryptographic protection, security monitoring, incident management, operational resilience and technology lifecycle management.
• Awareness of emerging technology and risk areas, including cloud security, DevSecOps, automation, artificial intelligence, open-source software, third-party concentration and evolving cyber threats.
• Experience applying recognized frameworks and standards such as COBIT, NIST, ISO 27001, ITIL and relevant regulatory expectations; professional certifications such as CISA, CISSP, CRISC, or equivalent is desirable.
• Strong analytical and problem-solving capability, with the confidence to challenge senior stakeholders and translate complex technical matters into concise, risk-based findings and practical remediation actions.
• Excellent written and verbal communication, stakeholder management and influencing skills, with the ability to work independently, manage competing priorities and deliver high-quality outcomes.
• Experience working in Agile and DevOps environments; knowledge of Google Cloud Platform (GCP) and its control environment would be an advantage.
• Proven ability to leverage AI tools to enhance productivity, optimize workflows to solve business problems, while applying critical judgment to ensure responsible and ethical use of data and AI outputs.