Position Overview:

As Vice President of ICT, you will be responsible for the implementation, management, and oversight of the 2nd line of defense (2LOD) risk management framework within ICT, supporting territories across the APAC region.

Job Responsibilities

RISK ORM ICT ISPL Governance & Oversight

- Provide IT & Cyber risk management oversight and advisory to the business, technical and operations groups (working with 1, 2, and 3LOD).
- Provide direction, support, and oversight regarding the management of security and technology risks of core systems and applications.
- Drive effective implementation and communication of Operational Risk Management policies and guidelines.

Risk Management Environment

- Identification & Assessment: Ensure effective operational risk identification across the organization via Audit Findings, Internal/External Loss Data, RCSA, Business Process Mapping, KPIs/KRIs, Scenario Analysis, and Quantified Measurement.
- Monitoring & Reporting: Implement processes to monitor operational risk profiles and material exposure; provide reporting to the board, senior management, and business lines.
- Control & Mitigation: Review the control environment, risk assessment processes, and control activities; assess risk response strategies and validate risk transfer options.
- Risk Disclosure: Provide updates on regulatory and financial disclosures; define the approach for determining operational risk disclosures and implement verification processes.

Contributing Responsibilities

- Contribute to the establishment of an IT & Cyber Risk Management program across the Bank and ISPL in alignment with the Group Risk Management Framework.




- Assist with establishing risk management governance committees and oversight of the Operational Risk Management infrastructure.
- Business Resiliency & Continuity: Oversee and drive business resiliency and continuity plans to limit losses during disruptions; coordinate with 1st and 3rd lines of defense for testing.

Required Qualifications, Capabilities, and Skills

- 15 + years of experience or equivalent expertise in technology risk management, cybersecurity, or a similar role within the financial services industry
- Experience in managing Enterprise Risk, necessary Controls, and infrastructure security.
- Robust experience in the Third Party Risk assessment process.
- Proven track record in managing risk and technology in large/global organizations.
- Experience in regulated environments (specifically Financial Services).
- Experience with EU regulations (DORA, CRA, GDPR) and US cybersecurity frameworks (NIST).
- Security Architecture, Malware Protection, Identity & Access Management, Secure Configuration, Security Testing, and Emerging Technology Security.
- Network devices, servers, Firewall, IDS, IPS, SIEM, DLP, Proxy, Web/Email Content Filtering, and Anti-Virus/Malware protection.
- Vulnerability assessments, penetration testing, incident response, and cyber incident management.
- ISO 2700X series, IT Service Management, and Service Continuity domains.

Preferred Qualifications, Capabilities, and Skills

- Relevant Information Security qualifications such as CISA, CISM, or CRISC.
- Understanding of emerging technologies (e.g., IoT, Cloud, etc.) and large-scale technology infrastructure.
- Experience with risk management tools and information systems.
- Significant experience in Technology Risk Management, Operational Resilience, Cyber, Information Security, and Crisis Management.

📌 Vice President, ICT Cyber & Technology Risk (Mumbai)
🏢 BNP Paribas
📍 Mumbai