Third Party Technology Risk Management Analyst/ Consultant

Job Description

Job Title: Third Party Technology Risk Management Analyst/ Consultant

Department: Cardif France

About Business line/Function: TG-CDF / TPTRM is an unique community to spot, assess, and mitigate the vulnerabilities and exposures introduced by external vendors, suppliers, and partners.

Position Purpose: The BNP Paribas Cardif Governance, Risk and Compliance team supports IT and Business Units to create adequate solutions on operational IT and Cyber risk management practices, 

with specific specialise in Information Security. 

• Their main missions are:  

• Spot operational IT and Cyber risks on assets/applications, projects and 3rd-parties.  

• Advice, consult, monitor and report on risk treatment in order to reduce the overall risk exposure of IT and Business at an optimized cost.  

• Elaborate and handle the implementation of a flexible strategy to reduce IT and Cyber risks in accordance with the IT and Information Security policies of BNP Paribas Group.  

Responsibilities

Direct Responsibilities

·         Instruct the 5 European Bank Authority (EBA) ICT risks categories among them ICT availability and continuity, ICT security, ICT change, ICT data integrity, and ICT outsourcing risks and to follow them throughout TPTRM assessments

·         Carry out third-party technology risk assessments to help beneficiaries/contract owners pinpoint and evaluate multi-layered business and technology risks related to their third parties, and offer recommendations for handling those risks 

·         Give periodic status updates such as potential risks and delays to the project delivery to beneficiary project manager, conduct workshops wherever necessary.

·         Assist in the selection and tailoring of third-party technology risk management approaches, methods and tools to support delivery of third-party cyber risk assessment services.

·         Review thoroughly Asset classifications and pre-existing asset related risks & control responses securing sync with TPTRM assessments responses; create the Security Annex that allows proper monitoring of the provider in the contract, and if needed contribute to the negotiation.

·         Spot core actors for decision making according to flagged risk families 

·         Apply group key procedures, templates, to carry out risk’s activities 

·         Guarantee to highlight core factors using Risk Assessment Form that will help SMEs in decision making 

·         Demonstrate grasp in one or more of the following cyber risk domains, such as: Security Governance and Management, Security Policies and Procedures, Application Security Controls, Access Controls, Network Security Operations, Security Architectures, Identity Management, Disaster Recovery & Business Continuity, Incident Response, Risk Management, Privacy and Data Protection, Encryption and Inventories/data quality management.

Contributing Responsibilities

·         As part of its defined missions, the TPTRM Analyst/Consultant is in charge of executing - or supporting the execution of TPTRM Assessments involving - IT operational risks identification, assessment, documentation, treatment, monitoring and closing.

·         Document TPTRM risks, assess inherent and residual risks in the activity 

·         Analyze the root cause and the business impact 

·         Work towards mitigation plan and risk acceptance 

·         Give support to beneficiary/contract owner to implement residual actions 

·         Report to P&P/ ITRO/ Project Manager about main TPTRM risks information, warning, or alert 

·         Contribute to a range of exercises and reviews on controlling and assessing TPTRM risks 

·         As a TPTRM Analyst/ Consultant review if all the mandatory prior assessments are properly completed if not take necessary actions towards compliance 

·         Define and document a methodology, use group’s tool to run and document assessments and outcomes

·         Facilitate the business/sponsor/beneficiary/SME decision-making with deep analysis based on relevant flagged risk families

·         Offer support to provider teams/ contract owners and liaise/ assist to ensure proper assessments are made.

·         Oversee TPTRM inventory with follow-up tracker management and contribute if needed to the negotiation of the requirement mandatory or non-mandatory in the security annex of the contract

·         Monitor the process with specific and group standard indicators to steer the activity 

·         As an IRM team member this includes all or part of the following activities: 

o    Execute as First Line of Defense: Oversight of risk management and compliance, delivering support and guidelines to operational teams. 

o    Contribute to process improvement, upkeep with new policies, regulations, standards & guidelines 

o    Contribute to IRM IT risk awareness actions

Technical & Behavioral Competencies

Functional Abilities  

·         Background in IT Risk and Cyber Security domains in a financial institution demonstrating a high level of commitment and self-motivation. 

·         Exposure to the Finance & IT industry with a sound exposure to IT Operations, Application Security, and/or network administration, IPS 

·         Solid demonstrated know-how of Risk & Compliance, cybersecurity, cyber risk, cyber threats, Third Party Technology Risk Management/ Vendor assessments 

·         Risk grasp and awareness of risks combined with enthusiasm and a genuine interest in the position of Risk Assessment, Third Party Technology Risk Assessment, Risk Analysis in business and delivering Risk Opinion as a subject matter expert.  

·         Working grasp of global regulations, frameworks and standards(ISO, NIST, COBIT, PCI-DSS, HIPAA) and conversant in the tactics, techniques and procedures used by Risk adversaries.  

·         Demonstrates a calm professional approach, with a good understanding of delivery within time constraints and the need to escalate/inform departmental management as appropriate.  

·         IT understanding

Technical Competencies

·         Good understanding of enterprises and IT Businesses 

·         Good technical understanding of infrastructures and IT Security Productions and Systems

·         Background in vulnerability management and penetration testing

·         IT risk /Third Party risk analysis and management methods and should have worked on Risk management Tools like RSA Archer, Metric stream, ServiceNow etc 

·         Know-how of Cyber Resilience, IT continuity and business continuity

·         GRC - Governance, Risk Management and Compliance Management. 

·         Firewall and Internet technologies; Cloud Security, Banking Tools & Technologies.

·         Secure access control mechanisms; Encryption and Key management technics

Behavioral Capabilities

·         Robust Communication, Analytical and problem-solving abilities.

·         Proven organizational capabilities with outstanding multi-tasking, result oriented and prioritization abilities

·         Good documentation and reporting capabilities

·         Aptitude to work independently

·         Sound communication and interpersonal capabilities, able to communicate and relate easily with IT, Finance and back-office users

·         Good communication, technical writing/diagramming competencies

·         Attention to detail and accuracy 

·         Capacité for créativité and innovation 

·         Self-discipline

Specific Qualifications: 

·         One or more Industry-recognized information Security certifications such as CISSP, CISA, GCCC, CISM, CEH, CRISC, OSCP or Security+.

·         IT Security tools like Firewalls, IPS, WAF, Endpoint protection, Network security, etc. 

·         IT Auditing (ISO27001/2, NIST 800 Series, ISO27005, ISO42001)

·         Regulatory Compliance

·         MBA in Finance/Systems/IT, master’s in technology, Bachelor of Commerce, master’s in commerce, bachelor’s in science, bachelor’s in technology 

Abilities Referential (Required understanding, competencies and abilities)

Transversal Abilities:

• • Analytical Ability
  • Capacity to handle a project
  • Capability to understand, explain and support change
  • Capacity to create and adapt a process 
  • Capability to anticipate business / strategic evolution

Behavioral Capabilities: 

• • Communication competencies - oral & written
  • Attention to detail / rigor
  • Capability to provide / Results driven
  • Creativity & Innovation / Problem solving

Education Level: Bachelor’s Degree or Equivalent with at least 5 years of Experience. 

Location: Bangalore

About BNP Paribas Group:

BNP Paribas is the European Union’s leading bank and core player in international banking. It operates in 65 countries and has nearly 185,000 employees, among them more than 145,000 in Europe. The Group has main positions in its three main fields of activity: Commercial, Personal Banking & Services for the Group’s commercial & personal banking and several specialized businesses covering BNP Paribas Personal Finance and Arval; Investment & Protection Services for savings, investment, and protection solutions; and Corporate & Institutional Banking, focused on corporate and institutional client organisations. Based on its solid diversified and integrated model, the Group helps all its clients (individuals, community associations, entrepreneurs, SMEs, corporates and institutional client organisations) to realize their projects through solutions spanning financing, investment, savings and protection insurance. In Europe, BNP Paribas has four domestic markets: Belgium, France, Italy, and Luxembourg. The Group is rolling out its integrated commercial & personal banking model throughout several Mediterranean countries, Turkey, and Eastern Europe. As a core player in international banking, the Group has leading platforms and business lines in Europe, a sound presence in the Americas as well as a solid and fast-growing business in Asia-Pacific. BNP Paribas has implemented a Corporate Social Responsibility approach in all its activities, allowing it to contribute to the construction of a sustainable future, while securing the Group's performance and stability.

About BNP Paribas India Solutions:

Established in 2005, BNP Paribas India Solutions is a wholly owned subsidiary of BNP Paribas SA, European Union’s leading bank with an international reach. With delivery centers located in Bengaluru, Chennai and Mumbai, we are a 24x7 global delivery center. India Solutions services three business lines: Corporate and Institutional Banking, Investment Solutions and Retail Banking for BNP Paribas spanning the Group. Driving innovation and expansion, we are harnessing the potential of over 10000 employees, to deliver support and shape best-in-class solutions.

Commitment to Diversity and Inclusion

At BNP Paribas, we passionately embrace diversity and are committed to fostering an inclusive workplace where all employees are valued, respected and can bring their authentic selves to work. We prohibit Discrimination and Harassment of any kind and our policies promote equal employment chance for all employees and applicants, irrespective of, but not limited to their gender, gender identity, sex, sexual orientation, ethnicity, race, colour, national origin, age, religion, social status, mental or physical disabilities, veteran status etc. As a global Bank, we truly believe that inclusion and diversity of our teams is core to our success in serving our client organisations and the communities we operate in. As a global Bank, we truly believe that inclusion and diversity of our teams is main to our success in serving our clients and the communities we operate in.

This Third Party Technology Risk Management Analyst/ Consultant vacancy is based in Bengaluru.