Advisor - Business Risk & Control Management (Cuauhtémoc)

Role Purpose

Responsible for overseeing the management of all Information Security Risk (ISR) policies, processes and projects within their respective line of business to ensure that proportionate and effective information security controls are established and maintained.

Principal Accountabilities

• Undertake Information Security consultation – This is undertaken on both an ad‑hoc and organised basis and is vital for ensuring that information security controls are appropriate to the line of business and any risks identified by the line of business can be considered in the broader regional/global context
• Support the implementation of primary ISR controls – This involves engaging with the implementation of several large ISR projects including:
  • Training and Awareness
  • Information Classification
  • Securing Information (Storage, Transfer, Use, and Disposal)
  • Incident Management
  • End User Computing (EUC)
  • Remote Working
  • Third Party Risk Governance
  • Securing Third Party Data Transfers
  • Access Management
• Manage the secondary ISR controls – This involves checking compliance with ISR policy to ensure that physical and electronic information is appropriately secured throughout the information life‑cycle (storage, transfer, use, and disposal).
• Autonomously identify and manage information security risks that are specific to their line of business/function in conjunction with direction from the Chief Information Security Officer (CISO – also referred to as CIRO in some regions).
• Provide regular reporting to senior management and the regional ISR structure on risk and project progress.
• Engage business/department management to ensure ownership and remediation of internal/external audit and regulatory requirements pertaining to information security.
• Participate in all relevant conferences and meetings with the regional ISR structure.
• Oversee and participate in the implementation of all relevant projects/initiatives emanating from the regional ISR structure.
• Assess whether business projects adhere to ISR practices and take appropriate action to ensure remediation of any issue.
• Validate the design and operational effectiveness of key controls. Knowledge on framework methodology related to Internal Control assessment such as COSO:
  • Validate the design and operating effectiveness of the key controls through inspection, inquiry, observation, etc.
  • Document the control review to ensure control assessments are accurate, effective, comply with procedures and templates, and meet quality control requirements.
  • Actively challenge poor, inefficient or excessive controls, related to the key controls of the function.
  • Perform an end‑to‑end process walkthrough, to identify the key controls of the process, and to know if they comply with local or integral procedures.

Requirements

• Knowledge of information security trends and best practice (e.g. GASSP, ISO27001, etc).
• Knowledge of internal control trends and best practice (e.g. COSO, ISO31000).
• Previous experience in developing and implementing information security strategies and projects.
• Advanced skills in Office.
• Good English level.
• Familiarity with the Information Security sections of the Operations and IT FIMs.
• Excellent communication and interpersonal skills.
• Proven project and risk management capabilities with a focus on resolving complex problems.
• Effective team and matrix management skills in multi‑cultural environments.
• Working knowledge of applicable security/risk concepts and methodologies.
• Working knowledge of the underlying technologies within HSBC.
• Well organised, autonomous and determined.