Global Resilience Risk Specialist DevSecOps Senior Manager

If you’re looking for a career where you can make a real impression, join HSBC and discover how valued you’ll be.

HSBC is one of the largest banking and financial services organizations in the world, with operations in 62 countries and territories. We aim to be where the growth is, enabling businesses to thrive and economies to prosper, and, ultimately, helping people to fulfil their hopes and realize their ambitions.

Provide specialist, actionable and contextual guidance on Technology Risk, enabling business growth while ensuring risks remain within appetite. Review and challenge the design and operating effectiveness of controls relating to Technology Risk. Support Risk Stewards in assessing internal and external events, providing insights and lessons learned relevant to Technology Risk controls. Influence and guide stakeholders across all lines of defense so they can fulfil their roles and manage resilience risk in line with Group frameworks and stated appetite. Build and maintain relationships with external partners, regulators, industry bodies and other relevant stakeholders to remain current on Technology Risk developments. Collaborate with the wider GRR team to align specialist input, share insights and support consistent risk management outcomes. Partner with GRR Business & Functions teams and 1LOD to identify, assess, mitigate, monitor and report Technology Risks. Support implementation of Internal Audit and GRR recommendations, including improvements to the use of the Risk Framework for Technology Risk. Maintain awareness of GRR risk impacts associated with the role and act in a manner that reflects GRR risk considerations. Comply with HSBC internal control standards by following relevant procedures, maintaining appropriate records and implementing internal and external audit actions, including those raised by regulators, in a timely manner. Operate on a bank-wide basis, collaborating closely with GRR peers and providing RR technical advice and guidance to support their relationship management responsibilities. Provide technical advice and operate globally so stakeholders understand the Technology Risk control environment and related assessments, proportionate to the scale and nature of operations. Support GRR Business & Functions teams in explaining, in non-technical terms, the impact of issues, events and top or emerging risks that may require changes to controls, resources or business operations to remain within risk appetite. Support GRR Business & Functions teams in ensuring risk and control owners have a clear understanding of the effectiveness of the current control environment. Monitor the external environment to identify emerging Technology Risks early and provide detailed guidance on the controls required to mitigate them, supported by relevant cross-organization and industry relationships. Deliver tailored Technology Risk expertise to enable 1LOD to deploy and operate key mitigating controls effectively. Provide technical guidance to support the development and completion of GRR and regulatory reporting obligations, including RAS, top and emerging risks, risk profile reporting, RMM and Board reporting where relevant. Challenge and influence stakeholders to ensure specialist advice and guidance is understood, accepted and acted upon. Partner with relevant stakeholders to strengthen risk management culture and embed effective risk behaviors. Work closely with GRR Business & Functions teams and wider specialist teams to align priorities and deliver consistent outcomes. Promote diversity and demonstrate behaviors consistent with HSBC’s brand and organizational values. Work independently, prioritizing time and focusing across multiple technologies, stakeholders and deliverables. Balance the pace of technology adoption with the need to identify, assess and mitigate associated risks. Provide independent oversight and challenge across the SDLC (Software development lifecycle) or DevOps Environment - from development and testing through CI/CD (Continuous integration and Continuous Deployment) build and deployment - ensuring controls are effective in practice, not just by design. Assess whether security, quality, and release controls, including handling of Free and opensource (FOSS) components, keep pace with the speed of modern software delivery. Engage with engineering and platform teams to identify control gaps and drive timely remediation. Stay ahead of emerging risks from AI-assisted development and automation, ensuring existing DevOps/SDLC policies evolve to remain effective as these tools become part of the delivery process. Support continuous uplift of the control framework in line with evolving technology and regulatory expectations