Position Purpose:

Implementation, management and oversight of 2nd line of defense (2LOD) risk management framework within the Information and Communication Technology (ICT) supporting APAC region (14 territories).

Job Responsibilities

- Governance &
- Oversight:

Provide IT &

- Cyber risk management oversight and advisory to business, technical, and operations groups; provide direction for managing security and technology risks of core systems; drive implementation of Operational Risk Management policies.

- Risk Management Environment: Identification &

- Assessment:

Correlate Audit Findings, Internal/External Loss Data, RCSA, Business Process Mapping, KPIs/KRIs, and Scenario Analysis.

- Monitoring &

- Reporting:

Regularly monitor operational risk profiles and material exposure; provide reporting to the board and senior management.

- Control &

- Mitigation:

Review the control environment, assess risk response strategies, and validate risk transfer options.

- Risk Disclosure:

Update regulatory and financial disclosures in compliance with board-approved policies.

- Contributing Responsibilities:

Contribute to the establishment of an IT &

- Cyber Risk Management program in alignment with the Group Risk Management Framework.

- Assist in establishing risk management governance committees.

- Oversee Business Resiliency &

- Continuity plans to ensure ongoing operations during disruptions.

Required Qualifications, Capabilities, and Skills

- Graduate or post-graduate qualification in ICT , risk management, or control functions.

- 15years or more of experience or practical understanding in IT, IT Security, or other ICT domains.





- Technical Knowledge:

Strong understanding of Information Security Risks (Technology Risk, Business Continuity Risk, etc.).

- Functional knowledge in Security Architecture, Malware Protection, Identity &
- Access Management, Secure Configuration, Security Testing, and Emerging Technology Security.

- Understanding of network devices, servers, Firewall, IDS, IPS, SIEM, DLP, Proxy, Web/Email Content Filtering, and Anti-Virus.

- Understanding of vulnerability assessments, penetration testing, and incident response for cyber incidents.

- Understanding of ISO 2700X series standards and guidelines.

- Skills:Behavioural:

Decision Making, Client focused, Ability to collaborate/Teamwork, Attention to detail/rigor.

- Transversal:

Analytical Ability, Project management, Ability to develop others.

- Technical:

Business process re-engineering, functional and enterprise technical architecture, and IT Service Management/Service Continuity domains.

- Conduct:

Proactivity, transparency, and accountability regarding conduct risks.

Preferred Qualifications, Capabilities, and Skills

- Qualified Certifications:

CISA, CISM, or CRISC.

- Regulatory Expertise:

Experience with EU regulations (DORA, CRA, GDPR) and US cybersecurity frameworks (NIST).

- Specialized Experience:

Experience in managing Enterprise Risk and infrastructure security.

- Strong experience in Third Party Risk assessment processes.

- Experience with risk management tools and information systems.

- Experience with emerging technologies such as IoT and Cloud.

- Significant experience in Operational Resilience and Crisis Management.

📌 Vice President Operational Risk Officer (ICT & Cyber) (Mumbai)
🏢 BNP Paribas
📍 Mumbai