Associate Director-MSS BIRO

HSBC Holdings plc; Bengaluru; On-site; INR 1,800,000 - 3,000,000; Full time

Job summary

HSBC Holdings plc in India seeks an experienced risk leader for First Line Risk Management within MSS. You will guide BIRO initiatives, oversee risk controls, and partner with front-to-back teams to de-risk information security and cyber risks.

The role emphasizes RCA alignment, governance, and cross-region collaboration, requiring 12+ years in risk/control and information security certifications such as CISA, CISM or CRISC. Bengaluru-based senior position with global scope.

Qualifications

• Strong understanding of information security, technology & cyber risks and mitigating actions.
• Experience leading risk/control assessments and RCA activities.
• Ability to develop remediation plans and monitor risk reduction initiatives.

Responsibilities

• Oversee and direct risk officers and serve as primary contact for BIRO activities.
• Provide cyber and information security risk input to businesses and support RCA processes.
• Identify and document information security and cyber risks with Global BIRO guidance.
• Offer timely guidance on information security queries and drive de-risking of business processes.
• Develop monitoring plans and ensure robust risk reduction actions are implemented.
• Collaborate with 2LOD and other functions to ensure effective risk governance.

Skills

Information security

Cyber risk

Risk governance

Stakeholder management

Team leadership

Written communication

Autonomy

Cross-regional collaboration

Education

Information security certifications (CISA, CISM, CRISC)

Job description

Job Title: First Line Risk Management

• HSBC's Markets and Securities Services (MSS) business is one of the largest of its kind in the world. It combines sophisticated 24-hour global coverage with a detailed knowledge of local markets. The services are offered through a network of 87 treasury sites in more than 60 countries and territories worldwide. The trading and sales forces attend to customers that include the world's central banks, international and local corporations, institutional investors, financial institutions and other market participants. MSS specializes in foreign exchange, credits and rates, structured derivatives, equities and debt, equity and equity-linked capital markets.
• The Markets and Securities Services NFR is an extension of the Markets and Securities Services COO Office, and the Office will partner with business management in the embedding, remediation and improvement of the control environment in respect of key risks to the Markets and Securities Services businesses, including the testing and assurance requirements of the Group Operational Risk Management Framework. The office will deliver on control related priorities in a well-organized, effective, and collaborative manner.
• Business Information Risk Officers are responsible for discharging their responsibilities across the Businesses and Regions. This involves working directly with back, middle and front office staff, including Control Officers in each business, to ensure all Information Security, Technology and Cyber risks are appropriately identified, assessed, managed and tracked.
• The BIRO within Markets and Securities Services NFR will be a regional BIRO and support the broader MSS organisation by providing timely guidance and support to the business on information security related issues and supporting BIRO driven risk reduction activities including CTB initiatives. The scope of this role is Global MSS Business and the role holder shall use their subject matter expertise to drive de-risking of business processes.

In this role, you will:

Principal Accountabilities and Responsibilities (e.g., for Business, Customers and Stakeholders; internal control environment, etc.)

• Oversee and direct the work of the Risk Utility Business Information Risk Officers and being the first point of contact for activities undertaken by team.
• Be responsible for providing cyber and information security risk management input to the business in support of their overall operational risk management activities, working alongside the business management and control officers to articulate and understand risks and ensuring that they are reflected in business Risk Control Assessment (RCA) – driving related RCA activities as required.
• Assist the MSS business in the identification, documentation and resolution of information security and Cyber risk issues (liaising with relevant functions, e.g. Cybersecurity, where required) as guided by Global BIRO.
• Provide timely guidance to business on queries relating to information security, leveraging strong knowledge of Bank policies, industry good practice and requirements of NFR management process to drive de-risking of Business processes.
• Support the business in ensuring that technology, cyber and information security risks in the RCAs are adequately assessed, documented, with gaps identified and appropriate remedial actions agreed. Support the business in developing and executing appropriate monitoring plans for these risks.
• Provide SME input into risk reductions initiatives and support BIRO delivery of these initiatives by supporting programme management, reporting & governance activities for initiatives. Support the business by ensuring business owned risk reduction activities are robust and sustainable.
• Be responsible for providing Business and management with a view of their information risk landscape through appropriate assessment of technology, information security and cyber issues across the front-to-back businesses, reviewing the external risk landscape, available metrics and providing timely updates, and for re-visiting these assessments periodically to ensure ongoing relevance.
• Be responsible for undertaking deep dives of cyber and information technology issues, as directed by the Chief Control Officer and Global BIRO, recommending and delivering practical remediation activities.
• Develop relationships with Resilience Risk, and other 2LOD functions as required, ensuring 2LoD observations are understood and where required, remediation plans are in place and remediation is appropriately tracked and reported.

To be successful you will:

Functional Knowledge

Technical Skill

• Strong understanding of information security, technology & cyber risks and potential mitigating actions, industry / good practices and related risk/control frameworks
• Good understanding of technology and information security risk/control disciplines.
• Knowledge and management of information security, technology & cyber risks as part in the context of Operational Risk.

Educational Requirements

• Information Security certifications e.g. CISA, CISM, CRISC etc. will be an advantage

Others

Personal Skills

• Strong management skills including ability to delegate, negotiate and influence a range of stakeholders
• Excellent written communication, research and analytical skills
• Ability to work autonomously
• Ability to work across regions, and build relationships with stakeholders globally

Experience

• Minimum 12 years of risk & control experience – e.g. 2LOD / 1LOD operational risk, information security risk, audit with a focus on information security / information risk.
• Previous experience in leading teams and engaging with senior management.
• Performance of risk and controls assessments related to information technology and information security.

Hsbc.Com/Careers

You’ll achieve more at HSBC

HSBC is an equal opportunity employer committed to building a culture where all employees are valued, respected and opinions count. We take pride in providing a workplace that fosters continuous professional development, flexible working and, opportunities to grow within an inclusive and diverse environment. We encourage applications from all suitably qualified persons irrespective of, but not limited to, their gender or genetic information, sexual orientation, ethnicity, religion, social status, medical care leave requirements, political affiliation, people with disabilities, color, national origin, veteran status, etc., We consider all applications based on merit and suitability to the role.”

Personal data held by the Bank relating to employment applications will be used in accordance with our Privacy Statement, which is available on our website.

***Issued By HSBC Electronic Data Processing (India) Private LTD***