:: VM Remediation Sr. Analyst :: Pan India

Senior Analyst for “Threats & Defects Remediation”

Our Technology teams work closely with HSBC’s global businesses to help design and build digital services that allow our millions of customers around the world to bank quickly, simply, and securely. We also run and manage our IT infrastructure, data centers, and core banking systems that power the world’s leading international bank.

Our multi-disciplined Technology teams include amongst others: DevSecOps engineers, IT architects, front and back-end developers, infrastructure specialists, cybersecurity experts, and delivery, project, and programme managers.

Following extensive investment across our Technology and Digital domains and with plans for continued expansion throughout 2023 and beyond, we are currently seeking a Senior Analyst for “Threats & Defects Remediation”, to join the HSBC Cybersecurity team within Technology.

Global Cybersecurity is responsible for enabling businesses and functions to manage their information, technology, and cybersecurity risks by ensuring these are well-understood, and that controls used to manage such events are defined, assessed, and implemented appropriately. Cybersecurity delivers this via objective, independent, professional, and specialized subject matter experts. The role forms part of the 1LoD in relation to risk management framework.

Cybersecurity is responsible for enabling businesses and functions to manage their information security risks as well as ensuring risk and controls are assessed and implemented appropriately, objectively, and independently through professional and specialized subject matter experts. The Cybersecurity Assessment and Testing (CSAT) function, part of Global Cybersecurity, is accountable for Vulnerability Management, Secure Development, Threat and Controls Assessment (threat modelling) and Third-Party Security Assessment.

What you will be doing.

The Vulnerability Threats & Defects Remediation Sr. Analyst role is with specific responsibilities to support the Remediation function lead in the day-to-day activities, ensure oversight of the Cybersecurity control environment globally, raise testing issues and perform related remediation activities. The Remediation team predominantly enables the timely closure of issues and mitigation of risk by proactively monitoring and establishing governance over remediation activities internally within the Cybersecurity functions and externally with the GB/GF/Regional IT and business teams.

This role will report into the Head of Vulnerability Threats & Defects Remediation, closely collaborating with peers across CBE GB/GF BISO/RISO delegates, CROS Penetration Testing, Threat Modelling and Service Management teams, enabling effective end-to-end vulnerability remediation.

Key Responsibilities:

• Lead governance forums on the remediation of the various findings identified through pen testing & threat modelling.
• Collaborate with all internal and external stakeholders through established governance channels to drive remediation of gaps and their tracking to closure. This includes implementing and maintaining an effective working relationship with key stakeholders internally and externally.
• Coordinate the remediation activities required for all security driven risks across all the customers (i.e., HOST, Cybersecurity function, global businesses, global functions, and regions).
• Proactively track the gaps identified during Security Assessments and other security testing activities completed by Cybersecurity functions and provide reports that support established governance to drive remediation of gaps and their tracking to closure.
• Maintain and document remediation plans, metrics and reports that support the team in tracking the closure of all Cybersecurity owned issues (audits, MSIIs).
• Ownership and management of escalations if remediation activities are not completed on time.
• Working closely with Metrics and Reporting team within Cybersecurity to establish effective security testing metrics to support governance and reporting requirements of the business.
• Providing guidance on the Remediation framework as required.
• Embedding a culture of individual self-improvement, development, and self-directed learning, whereby staff are expected to maintain subject matter expertise within their area of focus and more broadly within the realm of cybersecurity.
• Prepare operational reports by exporting data from existing sources (including Power BI dashboards, Service Now and Cyberport) to be presented in the various governance forums.
• Reviewing automated reports for data variances and creating/ implementing action plans to resolve identified issues.
• Ad hoc tasks as required, including support to other operational and governance activities within CSAT.
• Ensuring HSBC values and ‘tone of voice’ are maintained across all communication content and channels.

To be successful in this role, you should meet the following requirements:

• Minimum bachelor’s degree and/or experience in IT security governance and operational processes, preferably in the Financial Services industry or global corporate service provider
• Good understanding of Cybersecurity risk and control framework and familiarity with Information Security standards, policies, and key cyber regulations.
• Background – experience in Risk and Compliance Management, Vulnerability Management, Security Testing, etc.
• Ability to understand and assess both threats, controls, and vulnerabilities, articulating these to both technical and business stakeholders.
• Qualifications – one or more industry-recognised and cybersecurity-related certifications including CISA, CRISC, CISM, CISSP, CGEIT. This is preferred however not essential.
• Positive and professional attitude, team player, flexible and adaptable.
• Confident and takes responsibility and ownership for work and personal development.
• Ability to produce clear and concise reports for targeted audiences including senior management.
• Good spoken and written communication and ability to adapt style based on audience (Fluent in spoken / written English).
• Ability to build strong relationships and communicate on complex issues with a wide spectrum of stakeholders.
• Influential, credible, and persuasive, active listener, embraces HSBC Values, shows good judgement and demonstrates high level of communication skills to achieve effective stakeholder management.
• Expert usage of Microsoft 365 tools, including the ability to create and understand Pivot tables and manipulate large data sets.
• Excellent organisational, administrative, analytical and data management skills, with the ability to work accurately and methodically whilst under pressure to meet deadlines.
• Pro-active, independent individual with a positive attitude who can work remotely.