Technology and Cyber Security Risk Management Analyst

Job Description

WTW Information & Cyber Security (ICS) Risk Management team requires a technology and cyber risk management analyst to support the team in the identification, assessment, treatment, and overall management of technology and cyber risks facing WTW (including but not limited to risk analysis, reporting and risk assessments). This role will also focus on implementing ICS risk management oversight of technology and cyber internal audit findings.

The Role:

This role will support the ongoing operations of the ICS risk management team with primary responsibilities including:

1. Technology and Cyber audit finding specific duties:
   1. Be the ICS risk management lead supporting validation of internal audit findings and appropriate remediation approach by Technology and Cyber functions to treat the risk within an acceptable risk-based timelines.
   2. Become an SME on the Internal Audit processes, schedules and support functional leads in agreeing remediation plans timeline based on the end to end internal audit processes.
   3. Analyse audit findings to identify generic indicators of risk, control design and effectiveness which might be systemic.
   4. Perform oversight of reporting of internal audit findings and provide constructive feedback and challenge.
   5. Be a point of contact to Technology and Cyber colleagues who might need some support in effective management of risk from internal audits.
   6. Be a point of contact for Internal Audit if they perceive any issues potentially affecting the timely completion of the audit findings.
   7. Support development of KRIs to assist Technology and Cyber functional management effectively manage risk raised from internal audit findings.
   8. Support the consideration of MAP findings and how these align to technology and cyber control design and effectiveness verification and how these might impact the technology and cyber risk profile.

In addition, this role will support the ICS Risk Management team on other processes relating to management of technology and cyber risk, including:

1. Support performing risk identification, assessment, treatment, reporting and governance processes relating to effective management of technology and cyber risk.
2. Support the management of the Technology and Cyber Risk Management Frameworks and related automation of processes.
3. Support the building of an effective culture of technology and cyber risk management through awareness and education.

Qualifications

The Requirements:

Skills:

1. Experience of technology and cyber internal audits within the structure of 3 lines of defense.
2. Knowledge and experience of technology and information and cyber security risk and controls frameworks and related processes.
3. Experience of technology and cyber risk and issue management.
4. Strong stakeholder management, ability to foster and grow relationships, constructive challenge and negotiation skills.
5. Excellent communication skills, especially written English.
6. Knowledge of GRC tool such as Riskonnect would be an advantage.
7. Knowledge and understanding of Information Security Frameworks and standards (FFIEC, NIST, ISO etc).
8. Experience of implementations using Agile approach and practices.
9. Proven ability as a team member with ability to prioritise conflicting deadlines and priorities, and respond quickly to changing priorities and work effectively on their own initiative.
10. Experience of analysing reporting submissions for completeness and accuracy, and addressing areas of concern with contributors.
11. Able to interpret & present data and information in the appropriate format for different audiences.
12. Detail-oriented and capable of delivering at a high level of accuracy.

Qualifications:

1. Educated to degree level or equivalent.
2. Hold professional qualifications in a relevant subject; for example, CRISC, CISSP, CISM, CISA.
3. Strong extensive experience in technology role (with proven experience of active management of technology and cyber risks (for example, in projects, technical SME areas etc.).
4. Experience of working within a global financial and regulated organisation.

Behaviors:

1. Global team player with good interpersonal skills.
2. Core competencies in regard to influence, negotiation, conflict resolution and assertiveness.
3. Resourcefulness and organizational agility.
4. Customer focus, integrity and trust.
5. Personal learning & development.

Equal Opportunity Employer

At WTW, we believe difference makes us stronger. We want our workforce to reflect the different and varied markets we operate in and to build a culture of inclusivity that makes colleagues feel welcome, valued and empowered to bring their whole selves to work every day. We are an equal opportunity employer committed to fostering an inclusive work environment throughout our organization. We embrace all types of diversity.

At WTW, we trust you to know your work and the people, tools and environment you need to be successful. The majority of our colleagues work in a "hybrid" style, with a mix of remote, in-person and in-office interactions dependent on the needs of the team, role and clients. Our flexibility is rooted in trust and "hybrid" is not a one-size-fits-all solution.