Senior Specialist, Technology Risk Management
MSD
Stand out for this role — generate a tailored resume and cover letter in about a minute.
Job summary
MSD in Hyderabad is seeking a highly analytical, technically proficient Business Technology Risk Specialist to join our global health-care technology risk team. You will drive comprehensive risk assessments, vendor due dil igence, and risk advisory across core IT landscapes.
You will translate complex findings into actionable recommendations, support risk governance, and collaborate with security and engineering teams to strengthen controls and resilience. Hybrid work arrangements apply.
Qualifications
- Bachelor's degree in Information Technology, Computer Science, Cybersecurity, Engineering, or related discipline.
- 5+ years of experience in Technology Risk Management, Cybersecurity, IT Audit, Third-Party Risk Management, Security Architecture, or related disciplines.
- Strong experience conducting technology and cybersecurity risk assessments.
- Experience assessing third-party vendors, cloud providers, and supplier-hosted solutions.
- Strong understanding of enterprise applications and technology architectures.
- Demonstrated ability to identify control gaps and articulate business impacts.
Responsibilities
- Conduct end-to-end technology risk assessments across applications, infrastructure, cloud platforms, data platforms, AI/ML solutions, and third-party services.
- Lead technical due diligence reviews for vendors, suppliers, SaaS providers, and cloud service providers.
- Assess risks across enterprise applications, APIs, integrations, identity services, and cloud-hosted workloads.
- Evaluate identity and access management, data protection, logging, and resilience controls.
- Develop risk treatment plans and remediation recommendations.
- Translate risk findings into executive summaries and dashboards.
Skills
Education
Job description
- Based in Hyderabad, join a global healthcare biopharma company and be part of a 130- year legacy of success backed by ethical integrity, forward momentum, and an inspiring mission to achieve new milestones in global healthcare.
- Be part of an organisation driven by digital technology and data-backed approaches that support a diversified portfolio of prescription medicines, vaccines, and animal health products.
- Drive innovation and execution excellence. Be a part of a team with passion for using data, analytics, and insights to drive decision-making, and which creates custom software, allowing us to tackle some of the world's greatest health threats.
- Based in Hyderabad, join a global healthcare biopharma company and be part of a 130- year legacy of success backed by ethical integrity, forward momentum, and an inspiring mission to achieve new milestones in global healthcare.
- Be part of an organisation driven by digital technology and data-backed approaches that support a diversified portfolio of prescription medicines, vaccines, and animal health products.
- Drive innovation and execution excellence. Be a part of a team with passion for using data, analytics, and insights to drive decision-making, and which creates custom software, allowing us to tackle some of the world's greatest health threats.
Our Technology Centers focus on creating a space where teams can come together to deliver business solutions that save and improve lives. An integral part of our companys’ IT operating model, Tech Centers are globally distributed locations where each IT division has employees to enable our digital transformation journey and drive business outcomes. These locations, in addition to the other sites, are essential to supporting our business and strategy.
A focused group of leaders in each Tech Center helps to ensure we can manage and improve each location, from investing in growth, success, and well-being of our people, to making sure colleagues from each IT division feel a sense of belonging to managing critical emergencies. And together, we must leverage the strength of our team to collaborate globally to optimize connections and share best practices across the Tech Centers.
We are seeking a highly analytical, technically proficient, and business-oriented Business Technology Risk Specialist to join our Business Technology Risk (BTR) organization.
- Conduct end-to-end technology risk assessments across applications, infrastructure, cloud platforms, data platforms, AI/ML solutions, and third-party services.
- Evaluate inherent, residual, and emerging risks associated with new technologies and business initiatives.
- Assess technology implementations against corporate security standards, risk management requirements, and regulatory expectations.
- Facilitate risk identification workshops with business and technical stakeholders.
- Develop risk scenarios, risk statements, impact assessments, and treatment recommendations.
- Lead technical due diligence reviews for vendors, suppliers, SaaS providers, managed service providers, and cloud service providers.
- Assess security architecture, data flows, application designs, integrations, and hosting environments of third-party solutions.
- Review SIG questionnaires, security assessments, penetration test reports, SOC reports, audit reports, and vendor security documentation.
- Identify control gaps and determine appropriate risk ratings and treatment strategies.
- Advise business owners on vendor onboarding risks, compensating controls, and residual risk acceptance considerations.
- Support ongoing monitoring of high-risk vendors and critical third-party relationships.
- Assess risks associated with enterprise applications, APIs, integrations, identity services, cloud-hosted workloads, and business platforms.
- Evaluate application architecture against secure design and security engineering principles.
- Review authentication, authorization, session management, encryption, secrets management, logging, monitoring, and resilience controls.
- Analyze technical findings from Penetration tests, Red team exercises, Vulnerability assessments, Architecture reviews, Threat modeling engagements, Cloud security assessments.
- Identify root causes and recommend practical remediation actions.
- Assess design and operating effectiveness of technology and cybersecurity controls.
- Evaluate preventive, detective, corrective, and compensating controls.
- Validate effectiveness of Identity & Access Management (IAM), Privileged Access Management (PAM), Endpoint Security, Vulnerability Management, Network Security, Logging & Monitoring, Data Protection Controls, Disaster Recovery & Business Resilience, Cloud Security Controls.
- Support control maturity assessments and continuous improvement initiatives.
- Maintain risk registers and document technology risks in accordance with enterprise risk management processes.
- Facilitate risk discussions with technology teams, security engineers, architects, auditors, and leadership.
- Challenge assumptions and validate evidence supporting risk decisions.
- Ensure risks are accurately documented, quantified, escalated, and tracked through resolution.
- Support risk acceptance and remediation approval processes.
- Translate complex technical findings into clear business risk language.
- Develop executive-level risk summaries, dashboards, briefings, and presentations.
- Provide concise insights on Risk trends, Emerging threats, Control effectiveness, High-risk vendors, Strategic technology initiatives.
- Support CISO, senior leadership, and risk committees with risk-informed recommendations and decision support.
- Present risk outcomes and mitigation strategies to executive stakeholders with confidence and credibility.
- Monitor evolving threat landscapes, attacker techniques, and emerging technology risks.
- Provide risk advisory for strategic transformation initiatives including Cloud modernization, AI/Generative AI adoption, Digital transformation programs, Large-scale platform migrations, Mergers, acquisitions, and integrations.
- Partner with architecture, engineering, compliance, and cybersecurity teams to embed risk considerations early in the solution lifecycle.
The ideal candidate should possess working knowledge across the following domains
- Secure SDLC
- OWASP Top 10
- API Security
- Authentication & Authorization
- Secrets Management
- Data Protection
- Threat Modeling
- AWS
- Azure
- SaaS Security
- Cloud Security Posture Management
- Identity and Federation
- Container & Kubernetes Security
- Operating Systems
- Active Directory
- Network Architecture
- Segmentation
- Endpoint Security
- Vulnerability Management
- IT Risk Assessments
- Control Assessments
- Risk Treatment Planning
- Risk Acceptance Frameworks
- Risk Registers
- Governance Processes
- SIG Framework
- SOC Reports
- Vendor Security Assessments
- Third-Party Due Diligence
- Supply Chain Risk
- Vendor Continuous Monitoring
- Bachelor's degree in Information Technology, Computer Science, Cybersecurity, Engineering, or related discipline.
- 5+ years of experience in Technology Risk Management, Cybersecurity, IT Audit, Third-Party Risk Management, Security Architecture, or related disciplines.
- Strong experience conducting technology and cybersecurity risk assessments.
- Experience assessing third-party vendors, cloud providers, and supplier-hosted solutions.
- Strong understanding of enterprise applications and technology architectures.
- Demonstrated ability to identify control gaps and articulate business impacts.
- Experience developing risk treatment plans and remediation recommendations.
- Excellent written, verbal, and presentation skills.
- Ability to communicate effectively with both technical teams and executive leadership.
- Professional certifications such as CISSP CISM CRISC CISA AWS Security Specialty Azure Security Engineer
- Experience in pharmaceutical, healthcare, or regulated industries.
- Familiarity with AI/GenAI risk assessments.
- Experience supporting executive risk committees or CISO organizations.
- Experience with Archer, ServiceNow GRC, ARAVO, OneTrust, or similar risk platforms
We are known as Merck & Co., Inc., Rahway, New Jersey, USA in the United States and Canada and MSD everywhere else. For more than a century, we have been bringing forward medicines and vaccines for many of the world's most challenging diseases. Today, our company continues to be at the forefront of research to deliver innovative health solutions and advance the prevention and treatment of diseases that threaten people and animals around the world.
Imagine getting up in the morning for a job as important as helping to save and improve lives around the world. Here, you have that opportunity. You can put your empathy, creativity, digital mastery, or scientific genius to work in collaboration with a diverse group of colleagues who pursue and bring hope to countless people who are battling some of the most challenging diseases of our time. Our team is constantly evolving, so if you are among the intellectually curious, join us—and start making your impact today.
Application Security, Cloud Security, Information Security, Infrastructure Security, IT Risk Assessments, Risk Management
#MSDHYDIT
Regular
Domestic
No
No Travel Required
Hybrid
Not Indicated
No
n/a
- A job posting is effective until 11 59 59PM on the day BEFORE the listed job posting end date. Please ensure you apply to a job posting no later than the day BEFORE the job posting end date.
R415133
'/%3e%3cpath%20d='M101.744%2012.4726L102.894%2016.1947L99.0021%2013.2201L101.744%2012.4726ZM105.3%208.40937H100.488L99.0026%203.59473L97.5116%208.41047L92.7%208.40385L96.5965%2011.3834L95.1055%2016.1942L99.0021%2013.2196L101.408%2011.3834L105.3%208.40992V8.40937Z'%20fill='white'/%3e%3cdefs%3e%3clinearGradient%20id='paint0_linear_5593_1381'%20x1='90'%20y1='9.44471'%20x2='99'%20y2='9.44471'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%2300AD70'/%3e%3cstop%20offset='0.998594'%20stop-color='%2300B67A'/%3e%3cstop%20offset='1'%20stop-color='%23DCDCE6'/%3e%3c/linearGradient%3e%3c/defs%3e%3c/svg%3e){kind=small}
