IT Application Owner – AVP

Job Title: ITAO(IT Application Owner) AVP

Location: Pune, India

ITAO is the custodian of the application and is responsible to apply and enable during Life-Cycle of the application the IT policies and procedures with specific consideration to IT management and Information Security. The ITAO ensures a clear separation of the responsibility within the project, aimed at achieving a safe and secure running of the application and compliance to regulations, policies and standards. ITAO is responsible for application documentation, application infrastructure reliability and compliance, and is usually the IT SPOC for audit initiatives.

• Best in class leave policy
• Gender neutral parental leaves
• 100% reimbursement under childcare assistance benefit (gender neutral)
• Flexible working arrangements
• Sponsorship for Industry relevant certifications and education
• Employee Assistance Program for you and your family members
• Comprehensive Hospitalization Insurance for you and your dependents
• Accident and Term life Insurance
• Complementary Health screening for 35 yrs. and above

Your key responsibilities

Strategy & Architecture

• Enterprise IT governance: Reviews current and proposed information systems for compliance with the organisation's obligations (including legislation, regulatory, contractual and agreed standards/policies) and adherence to overall strategy. Provides specialist advice to those accountable for governance to correct compliance issues.
• Cloud Security & Governance : Migration on Cloud from on-prem setup end to end with ensuring application/infrastructure and Data Security
• Information security: Communicates information security risks and issues to business managers and others. Performs basic risk assessments for small information systems. Contributes to vulnerability assessments. Applies and maintains specific security controls as required by organisational policy and local risk assessments. Investigates suspected attacks. Responds to security breaches in line with security policy and records the incidents and action taken.
• Information content publishing: Understands technical publication concepts, tools and methods and the way in which these are used. Uses agreed procedures to publish content. Obtains and analyses usage data and presents it effectively. Understands, and applies principles of usability and accessibility to published information.
• Specialist advice: Actively maintains knowledge in one or more identifiable specialisms. Provides detailed and specific advice regarding the application of their specialism(s) to the organisation's planning and operations. Recognises and identifies the boundaries of their own specialist knowledge. Collaborates with other specialists, where appropriate, to ensure advice given is appropriate to the needs of the organisation.
• Knowledge management: Maintains knowledge management systems and content to meet business needs. Supports others to enable them to complete knowledge management activities and form knowledge management habits. Reports on progress of knowledge management activities. Configures and develops knowledge management systems and standards. Supports changes to work practices to support capture and use of knowledge.
• Business risk management: Investigates and reports on hazards and potential risk events within a specific function or business area.
• Continuity management: Implements and contributes to the development of a continuity management plan. Coordinates the assessment of risks to the availability, integrity and confidentiality of systems that support critical business processes. Coordinates the planning, designing, and testing of maintenance procedures and contingency plans.
• Data management: Assists in providing accessibility, retrievability, security and protection of data in an ethical manner.
• Methods and tools: Provides support on the use of existing method and tools. Configures methods and tools within a known context. Creates and updates the documentation of methods and tools.
• To maintain the Information Security related documentation of assigned IT Assets in the DB Group IT Asset inventory.

Change and Transformation

• Requirements definition and management: Assists in the definition and management of requirements. Uses standard techniques to elicit, specify, and document requirements for simple subject areas with clearly-defined boundaries. Assists in the creation of a requirements baseline and in investigating and applying authorised requests for changes to base-lined requirements, in line with change management policy.

Delivery and operation

• Availability management: Contributes to the availability management process and its operation and performs defined availability management tasks. Analyses service and component availability, reliability, maintainability and serviceability. Ensures that services and components meet and continue to meet all of their agreed performance targets and service levels. Implements arrangements for disaster recovery and documents recovery procedures. Conducts testing of recovery procedures.
• Service acceptance: Engages with project management to confirm that products developed meet the service acceptance criteria and are to the required standard. Feeds into change management processes.
• Configuration management: Applies tools, techniques and processes to track, log and correct information related to configuration items. Verifies and approves changes ensuring protection of assets and components from unauthorised change, diversion and inappropriate use. Ensures that users comply with identification standards for object types, environments, processes, lifecycles, documentation, versions, formats, baselines, releases and templates. Performs audits to check the accuracy of information and undertakes any necessary corrective action under direction.
• Asset management: Applies tools, techniques and processes to create and maintain an accurate asset register. Produces reports and analysis to support asset management activities and aid decision making.
• Change management: Develops implementation plans for complex requests for change. Evaluates risks to the integrity of service environment inherent in proposed implementations (including availability, performance, security and compliance of the business services impacted). Seeks authority for those activities, reviews the effectiveness of change implementation, and suggests improvement to organisational procedures governing change management. Leads the assessment, analysis, development, documentation and implementation of changes based on requests for change.
• Security administration: Investigates minor security breaches in accordance with established procedures. Assists users in defining their access rights and privileges. Performs non-standard security administration tasks and resolves security administration issues.
• Application support: Drafts and maintains procedures and documentation for applications support. Manages application enhancements to improve business performance. Advises on application security, licensing, upgrades, backups, and disaster recovery needs. Ensures that all requests for support are dealt with according to set standards and procedures.
• Problem management: Ensures that appropriate action is taken to anticipate, investigate and resolve problems in systems and services. Ensures that such problems are fully documented within the relevant reporting system(s). Enables development of problem solutions. Coordinates the implementation of agreed remedies and preventative measures. Analyses patterns and trends.
• To support key role holders such as ITAOs and ISOs to develop a secure environment by evaluating the IT Security requirements as early as possible in the system development life cycle to select the applicable information security controls for implementation. To guide ITAOs on the implementation of compensating controls in case of deviations from the applicable information security controls.
• To approve the access control and user authorization approach of the assigned IT Assets. To execute and document periodical recertification of Access Rights in compliance with the DB Group Identity and Access Processes.

Incident management: Ensures that incidents are handled according to agreed procedures. Investigates escalated incidents to responsible service owners and seeks resolution. Facilitates recovery, following resolution of incidents. Ensures that resolved incidents are properly documented and closed. Analyses causes of incidents, and informs service owners in order to minimise probability of recurrence, and contribute to service improvement. Analyses metrics and reports on performance of incident management process.

Your skills and experience

Experience 6 to 9 years

• IT Service Management, IT Governance or IT Project Management background.
• Excellent communication and presentation skills, highly organized and disciplined.
• Experienced in working with multiple stakeholders. Ability to create and naturally maintain good business relationships with all stakeholders.
• Comfortable working in VUCA (Volatility Uncertainty Complexity Ambiguity) and highly dynamic environments.
• Rounded knowledge and experience of all the following Information Security processes;
  • Application and Infrastructure Security
  • Identity and Access management
  • Information Security Incident and Problem Management
  • Information Security Governance for business and technology
  • Information Security Risk Management
• Expert knowledge of DB Information Security Principles, Policies, and Procedures
• Profound experience in business and IT processes and respective Information Security requirements.
• Extensive experience with financial markets and institutions.
• Excellent analytical skills, flexibility regarding problem solving.
• Ability to work in fast paced environment and keep pace with technical/ operational innovation.
• Open minded, able to share information, transfer knowledge and expertise to team members.
• Keeps pace with technical/operational innovation & maintains understanding of the CIO technologies, as well as CISO service and technology offerings
• ITAO will typically have a rather limited technical hands on involvement. A high-level understanding on the products/technologies below is welcomed:
  • Databases: mainly Oracle
  • Application/web servers (like J2EE based, especially JBoss, Tomcat, WebLogic Server, Apache)
  • Management of security certificates.
  • Unix servers very basic administration
  • Microservices and SOA
  • Communication and encryption protocols (mainly HTTP(S), SSL)
  • Networking (firewalls, load balancers, etc)
  • High Availability Architecture.
• Reasonable understanding and relevant experience in Agile-Scrum delivery and main tools (Jira & Confluence);
• 4-5 years of work experience in IT;
• 2-3 years project management or application owner experience.

Preferable skills:

• Experience working with distributed development teams;
• Experience in finance products
• Experience on Google Cloud Security and Management
• Degree in Information Security or a comparable education
• In addition, the following education/certification attainment will be beneficial:
• CISSP (Certified Information Systems Security Professional) or equivalent.
• ISSMP (Information Systems Security Management Professional).
• CISM (Certified Information Security Manager) or equivalent

Skills and quality

• Quality assurance: Contributes to the collection of evidence and the conduct of formal audits or reviews of activities, processes, data, products or services. Examines records for evidence that appropriate testing and other quality control activities have taken place and determines compliance with organisational directives, standards and procedures. Identifies non-compliances, non-conformances and abnormal occurrences.
• Conformance review: Collects and collates evidence as part of a formally conducted and planned review of activities, processes, products or services. Examines records as part of specified testing strategies for evidence of compliance with management directives, or the identification of abnormal occurrences.
• Digital forensics: Contributes to digital forensic investigations. Processes and analyses evidence in line with policy, standards and guidelines and supports production of forensics findings and reports.
• To contribute to the Information Security Incident Management Process in the case of a security breach for their IT-Assets, if requested.

Relationships and engagement

Relationship management: Identifies the communications and relationship needs of stakeholder groups. Translates communications/stakeholder engagement strategies into specific activities and deliverables. Facilitates open communication and discussion between stakeholders, acting as a single point of contact by developing, maintaining and working to stakeholder engagement strategies and plans. Provides informed feedback to assess and promote understanding. Facilitates business decision-making processes. Captures and disseminates technical and business information.

Experience/Exposure

• Autonomy: Works under general direction. Uses discretion in identifying and responding to complex issues and assignments. Receives specific direction, accepts guidance and has work reviewed at agreed milestones. Determines when issues should be escalated to a higher level.
• Influence: Interacts with and influences colleagues. Has working level contact with customers, suppliers and partners. May supervise others or make decisions whichimpactthe work assigned to individuals or phases of projects. Understands and collaborates on the analysis of user/customer needs and represents this in their work.
• Complexity: Performs a range of work, sometimes complex and non-routine, in a variety of environments. Applies methodical approach to issue definition and resolution.
• Knowledge: Has a sound generic, domain and specialist knowledge necessary to perform effectively in the organization typically gained from recognized bodies of knowledge and organizational information. Demonstrates effective application of knowledge. Has an appreciation of the wider business context. Takes action to develop own knowledge.
• Business skills: Demonstrates effective communication skills. Plans, schedules and monitors own work (and that of others where applicable) competently within limited deadlines and according to relevant legislation, standards and procedures. Contributes fully to the work of teams. Appreciates how own role relates to other roles and to the business of the employer or client. Demonstrates an analytical and systematic approach to issue resolution. Takes the initiative in identifying and negotiating appropriate personal development opportunities. Understands how own role impacts security and demonstrates routine security practice and knowledge required for own work.
• Cloud Migration and Understanding : Basic Knowledge on IaaS/PaaS/SaaS and migration from different environments to Cloud