New User: Apply to selected job without registration
  New User: Apply to selected job and register
Please fill in the below details to apply to the selected job.
If you are registred User, Login to Apply

Senior IT Risk Governance Associate

4 - 7 Years


Not Disclosed by Recruiter

Openings: 1Posted: 25 days agoJob Applicants: 243Job Views: 865
Send me Jobs like this

Job Description

Roles and responsibilities 

Information Technology provides products and services to ZS to ensure successful business outcomes. IT provides internal information technology solutions and support for ZS, including custom enterprise Web and ERP applications, IT infrastructure and technology support.

We are currently seeking applicants for the position of a Senior IT Risk Governance Associate to join our India IT Governance, Compliance and Audit team. The position will support various management directed, IT risk governance initiatives which include reviewing findings from vulnerability assessments, driving remediation of vulnerabilities, proactively identifying process and technical gaps which may result in potential audit issues, verifying that remediation plans are implemented and tracked through completion, preparing reports for senior leadership consumption, assisting with risk reporting activities to ZSs risk committees, creating and maintaining security risk scorecards based on risk and threat levels assigned to ZS managed assets and user populations, and preparing reports for internal and external stakeholder consumption.

Qualified candidates will possess the skills detailed below and relevant work experience. Please note, this position is not client facing and does not require travel to client sites, unless specifically directed by management. This position may require travel to other ZS offices to assist with governance related activities and internal audits, as directed.

  • Assist in maturing the first line of defense function across IT by helping establish requirements for monitoring IT controls across the organization;
  • Assist with developing a process, risk, control framework with IT to map organizational controls and assist with establishing accountability and ownership for IT risk management and control activities;
  • Track and verify adherence to information security polices procedures and requirements;
  • Analyze findings from security monitoring systems. Review all current and existing vulnerabilities for active and acceptable remediation plans;
  • Assist with preparing findings reports for review by various stakeholders which may include application owners, data owners and custodians, system administrators, other IT and business unit leadership and company level risk and audit committees;
  • Verify that remediation plans are implemented per remediation plan. Proactively review and identify any potential gaps that may result in possible audit issues;
  • Assist with reviewing vulnerability scan results to identify security risks and report on findings to appropriate stakeholders;
  • Assist with creating and managing security risk scorecards based on risk levels assigned to ZS managed assets and personnel with access to sensitive information (e.g. in accordance with a data classification matrix);
  • Assist compliance and audit team members with preparation of detailed plans for performing individual audits including identification of key risks and controls, determination of audit objectives, and input toward the development and maintenance of an appropriate internal audit program;
  • Provide input to risk assessment processes for key enterprise and client facing systems;
  • Incorporate feedback received from risk assessment processes, and internal and external audits to adjust and fine tune technology risk governance processes;
  • Demonstrate and apply a thorough understanding of complex information systems. Use knowledge of the current IT environment and industry IT trends to help with the identification of potential issues and risks;
  • Liaise with internal and external stakeholders to ensure IT compliance related documentation is kept up to date with ZSs compliance requirements, obligations and commitments, as needs evolve;
  • Liaise with appropriate stakeholders including IT, Legal, HR, Finance and others, as needed, to ensure that evolving compliance requirements are incorporated into risk governance processes;
  • Manage GRC tools lifecycle including tool configuration needs with appropriate internal and external stakeholders;
  • Assist with the development of appropriate IT compliance training material and conduct training of impacted stakeholders, as needed;
  • Assist with other technology risk governance related initiatives and special projects as assigned from time to time.

Required Candidate profile

  • BS/BA in Management Information Systems (MIS), computer science or related field with record of high academic achievement required;
  • 4+ years of experience in risk management and technology compliance disciplines: audits, regulatory compliance, risk management, program management and change management within the security governance and risk management space, required;
  • 2+ years of experience supervising IT audit engagement lifecycles (e.g. US SOX, US SOC1 & SOC2 audits) ISO 27001 audits, with minimal oversight. Lifecycle includes the planning, execution, communication, and reporting phases of an audit engagement;
  • 1+ year of experience project managing a team of junior staff, required
  • Experience in identification and remediation of security threats and risks;
  • Experience maintaining risk and control registers, audit plans, findings and remediation recommendation registers;
  • Experience with the use of collaboration tools (e.g. SharePoint Online or other GRC like tools) for reporting purposes is strongly preferred;
  • Detailed knowledge of how operational controls are implemented to meet compliance needs;
  • Skilled at preparing and presenting compliance and risks reporting at all levels of the company, from operational efforts through executive level presentation;
  • Broad understanding of information security policies and standards, and regulatory/framework compliance;
  • Strong communication skills, interpersonal skills, and presentation skills that allow effective interactions/communications with executives, business partners across regional and/or functional lines including the cascade of knowledge to the operating level;
  • Superior command over the English language, verbal and written; experience writing management and auditor level narratives and reports required;
  • Corporate or consulting firm risk management and governance experience required. Big 4 IT assurance/public accounting firm experience, while not required, is strongly preferred;
  • Experience documenting test results and narratives and also reviewing the work of others (e.g. junior staff) highly preferred;
  • Excellent communication and organizational skills preferably with international exposure;
  • Demonstrated ability to work independently and as part of cross office teams (e.g. US, India);
  • Ability and willingness to work hours which overlap with International time zones (e.g. US time zone);
  • Ability and willingness to travel to other ZS offices, as needed, to assist with compliance and audit engagements;
  • Certified or eagerness to become certified in IT audit/risk governance related certifications while working at ZS (e.g. CGEIT, CRISC, ISO27001 Lead Auditor).

Technical expectations include:
  • Basic working knowledge of web based applications, operating systems and databases including Windows Active Directory, Linux, Microsoft SQL and Oracle;
  • Proficient in MS Office productivity suite (e.g. Word, Excel, PowerPoint, Access, SharePoint). Advanced Excel Access database skills strongly preferred;
  • Working knowledge of GRC tools; experience working with an industry recognized GRC tool highly preferred
Working knowledge of various control frameworks including:

o COBIT Control Objectives for Information and Related Technology
o ISO/IEC 27001:2013 Code of Practice for Information Security Management
o NIST SP 800-53
o HIPAA/HITECH Security and Privacy Audit Protocol
o Shared Assessments Standard Information Gathering (SIG) framework

Basic working knowledge of various laws directly or indirectly impacting data security and privacy requirements worldwide including:

o US SOx Sarbanes Oxley Act
o EU GDPR General Data Protection Regulation
o US EU Privacy Shield
o India IT Act (data privacy provisions)
o India Companies Act

Salary: Not Disclosed by Recruiter
Industry: IT-Software / Software Services
Functional Area: IT Software - Application Programming, Maintenance
Role Category: Other
Role: Outside Consultant
Employment Type: Permanent Job, Full Time

Company Profile

ZS Associates India Pvt Ltd
ZS is a professional services firm that works side by side with companies to help develop and deliver products that drive customer value and company results. More than 6,000 ZS professionals in more than 20 offices worldwide draw on deep industry expertise, leading-edge analytics, technology and strategy to deliver impact where it matters for clients across multiple industries.

ZS India Capability & Expertise Center (CEC) houses more than 60% of ZS people across three offices in New Delhi, Pune and Bengaluru. Our teams work with colleagues across North America, Europe and East Asia to create and deliver real world solutions to the clients who drive our business. The CEC maintains standards of analytical, operational and technological excellence across our capability groups. Together, our collective knowledge enables each ZS team to deliver superior results to our clients
To learn more about ZS, visit .To explore our offices and the ZS lifestyle, read the Life at ZS blog at
View Contact Details+
Contact Details

Recruiter Name:Ashwini Nabar

Contact Company:ZS Associates India Pvt Ltd