Position Purpose: Implementation, management and oversight of 2nd line of defense (2LOD) risk management framework within the Information and Communication Technology (ICT) supporting APAC region (14 territories).

Job Responsibilities

- Governance & Oversight: Provide IT & Cyber risk management oversight and advisory to business, technical, and operations groups; provide direction for managing security and technology risks of core systems; drive implementation of Operational Risk Management policies.
- Risk Management Environment: Identification & Assessment: Correlate Audit Findings, Internal/External Loss Data, RCSA, Business Process Mapping, KPIs/KRIs, and Scenario Analysis.
- Monitoring & Reporting: Regularly monitor operational risk profiles and material exposure; provide reporting to the board and senior management.
- Control & Mitigation: Review the control workplace, assess risk response strategies, and validate risk transfer options.
- Risk Disclosure: Update regulatory and financial disclosures in compliance with board-approved policies.
- Contributing Responsibilities: Contribute to the establishment of an IT & Cyber Risk Management program in alignment with the Group Risk Management Framework.
- Assist in establishing risk management governance committees.
- Oversee Business Resiliency & Continuity plans to ensure ongoing operations during disruptions.

Required Qualifications, Capabilities, and Skills

- Graduate or post-graduate qualification in ICT , risk management, or control functions.
- 15years or more of experience or practical understanding in IT, IT Security, or other ICT domains.




- Technical Knowledge:Strong understanding of Information Security Risks (Technology Risk, Business Continuity Risk, etc.).
- Functional knowledge in Security Architecture, Malware Protection, Identity & Access Management, Secure Configuration, Security Testing, and Emerging Technology Security.
- Understanding of network devices, servers, Firewall, IDS, IPS, SIEM, DLP, Proxy, Web/Email Content Filtering, and Anti-Virus.
- Understanding of vulnerability assessments, penetration testing, and incident response for cyber incidents.
- Understanding of ISO 2700X series standards and guidelines.
- Skills:Behavioural: Decision Making, Client focused, Ability to collaborate/Teamwork, Attention to detail/rigor.
- Transversal: Analytical Ability, Project management, Ability to develop others.
- Technical: Business process re-engineering, functional and enterprise technical architecture, and IT Service Management/Service Continuity domains.
- Conduct: Proactivity, transparency, and accountability regarding conduct risks.

Preferred Qualifications, Capabilities, and Skills

- Qualified Certifications: CISA, CISM, or CRISC.
- Regulatory Expertise: Experience with EU regulations (DORA, CRA, GDPR) and US cybersecurity frameworks (NIST).
- Specialized Experience:Experience in managing Enterprise Risk and infrastructure security.
- Strong experience in Third Party Risk assessment processes.
- Experience with risk management tools and information systems.
- Experience with emerging technologies such as IoT and Cloud.
- Significant experience in Operational Resilience and Crisis Management.

📌 Vice President Operational Risk Officer (ICT & Cyber) (Mumbai)
🏢 BNP Paribas
📍 Mumbai