Technology Risk Analyst / Senior Analyst

New-TR-Staff At EY, were all in to shape your future with confidence. Well help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world. EY- Technology Risk Staff/Senior As part of our EY- Technology Risk team youll contribute technically to IT Risk and Assurance client engagements and internal projects. An important part of your role will be to actively establish, maintain and strengthen internal and external relationships. Youll also identify potential business opportunities for Ernst & Young within existing engagements and escalate these as appropriate. Similarly, youll anticipate and identify risks within engagements and share any issues with senior members of the team. The opportunity Were looking for Analyst to join the leadership group of our EY-Technology RIsk Team. This is a fantastic opportunity to be part of a leading firm whilst being instrumental in the growth of a new service offering. Your key responsibilities Evaluate a portfolio of controls for design effectiveness, operating effectiveness and/or risk management outcomes, raising issues as appropriate. Ensure that assigned control assessments are accurate, effective, abide by policy, procedures, and templates, and meet quality control requirements and are delivered on time, in accordance with the assessment plan. Test and supervise the delivery of assigned controls not limited to ITGC and ITAC but System Architecture, Operating Systems, Databases, Networks, Security Systems, Cloud Services, Asset Inventories, Incident Management, Recovery Management, ISO27001 & NIST assessment, Privacy Assessment, Cyber Maturity Assessment, IT Policies and Standards Assessment and Software Development Lifecycle (SDLC); using experience and knowledge to intervene and redirect testing as required, resolving, or redirecting escalations as required. Manage control owners and other stakeholders, ensuring the success of each assigned reviews, minimising contention where possible and requesting support, where deemed necessary. Apply judgement and risk management concepts to identify, formulate findings and provide valuable insights to the clients to improve processes and manage risks to achieving operational and strategic goals. Review IT Policies and Standards and ensure that they are as per the different industry standard. Work closely with cross-functional teams and develop strong relationships as project lead within IT security and GRC projects. Stay current with and promote awareness of applicable regulatory standards, upstream risks and industry best practices across the enterprise Control frameworks such as COSO, internal control principles and related regulations including SOX and J-SOX Familiar with IT industry frameworks such as ISO27001, NIST, PCI-DSS, SOX, FDA, HIPAA: Privacy, HIPAA: Security and HITECH Act. Third party reporting standards (particularly SSAE16), other reporting and industry specific standards and, if applicable, trust-based standards such as SysTrust and WebTrust. Skills and attributes for success Provide guidance and share knowledge with team members and participate in performing procedures especially focusing on complex, judgmental and/or specialized issues. Work with the team and the client to create plans for accomplishing engagement objectives and a strategy that complies with professional standards and addresses the risks inherent in the engagement Experience in conducting information security assessments including business continuity plan audits, network security audits, and infrastructure audits Perform NIST assessments, ISO assessments, and privacy impact audits, Data Privacy and GDPR implementation, experience in developing Data inventory and Third Party Risk Assessment. Maintain relationships with client management to manage expectations of service, including work products, timing, and deliverables. Demonstrate a thorough understanding of complex information systems and apply it to client situations Bring and utilize extensive knowledge of the client's business/industry to identify technological developments and evaluate impacts on the client's business. Demonstrate excellent project management skills, inspire teamwork and responsibility with engagement team members, and use current technology/tools to enhance the effectiveness of deliverables and services. Experience in conducting information security assessments including business continuity plan audits, network security audits, and infrastructure audits Understand EY and its service lines and actively assess what the firm can deliver to serve clients To qualify for the role, you must have Graduate (CS/ IT, Electronics, Electronics & Telecommunications,)/MBA/M.Sc. with at least 2-7 years of experience Bring your significant experience in applying relevant technical knowledge in at least one of the following engagements: (a) ISO assessments (b) NIST assessments