Control Owner Secrets Management

The role is based within the Cyber Security Identity Access Management (IAM) Controls Team. The IAM team are responsible for providing a best-in-class service to internal customers, cost effective operational delivery and the provisioning of an operational platform to support the Global Access Management strategy and future business growth. IAM supports Global Technology teams in minimising losses to the Bank through inappropriate access to systems, ensuring that HSBC's electronic based assets are monitored, managed, accessed, and protected effectively, so that only those people with a legitimate business need can access or modify them, when they need to do so. This is achieved through an IAM process framework and toolset and by measuring, monitoring, and reporting on both adherence to standards and quality of IT service performance. Our IAM Vision is to ensure all individuals across HSBC have the access to the right resources at the right times for the right reasons, enabling quality outcomes whilst delivering the Bank's regulatory requirements and managing risk. The role of a Secrets Management Control Owner is to develop, implement and monitor centralised Group IAM non-interactive authentication (i.e., Secrets Management) controls. The ideal candidate will have a strong background in Information Security and IAM and be responsible for ensuring the protection of sensitive data and systems through effective secrets management control practices for at least the following:

• Secrets storage and vaulting solutions
• Creation of a Secure Identity Framework for non-interactive identities This includes assessing and reporting on the status of the HSBC IT estate's compliance to Secrets Management Policy, Standards, and Operational Risk Controls. This role will execute on the following responsibilities:
• Develop, implement, and maintain secrets management control policies and procedures to ensure the protection of sensitive data and systems.
• Monitor secrets management control activities to ensure compliance with policies and procedures and report on this by introducing relevant Key Control Indicators (KCI's).
• Conduct regular reviews of secrets management control processes to identify and remediate any vulnerabilities or areas for improvement.
• Collaborate (as the control SME) with cross functional teams, including Cybersecurity, IT, and business units, to ensure secrets management control strategies align with organisational goals and requirements.
• Manage secrets management control lifecycle activities, including IT service change control eligibility.
• Oversee the administration of secrets management control services, including remediation of non-compliance instances.
• Stay current on industry trends and advancements in secrets management controls to identify opportunities for enhancement, automation, and innovation.
• Scanning the internal/external (regulatory and audit) requirements for the IAM function in relation to the secrets management control and ensuring that the policies and procedures are updated accordingly.
• Develop and deliver training and awareness programs to educate stakeholders on secrets management control practices and responsibilities. In addition to the details listed above, the ideal candidate will demonstrate:
• A desire to find ways to continually improve the service delivered to customers while inspiring them to adhere to control standards.
• A flexible and adaptable approach to change and will support others to respond in a similar way.
• An ability to communicate complex technical information to non-technical stakeholders and explain secrets management control policies and procedures in a clear, concise manner.
• Sound collaboration skills and the ability to support others.
• Ability to work in a diverse global environment with a positive, goal-orientated approach.
• Confident to work independently and take responsibility for own progress and development.
• Ability to balance multiple priorities while focusing on the broader goals. Qualifications/Experience:
• Cyber Security and IAM experience on controls
• Experience in supporting IAM change initiatives to deliver successful control outcomes.
• Advanced Excel skills essential.
• Technical and architectural skills are desirable.
• Strong analytical, technical, and problem-solving skills.
• Demonstrated experience of making timely and rational decisions, based on relevant information.
• Role relevant qualifications, i.e., CISSP/CISM/CISA is desirable.