Track Lead Operational Risk, SAP Security

Job description

Job Responsibilities : DR coordination: planning and preparation • Review the DR scope, scenarios and success criteria with architects and application owners before each exercise, and confirm RTO and RPO targets against business requirements. • Maintain the application recovery sequence and dependency map with application owners. • Maintain a call tree and escalation path for the DR exercise and for a real invocation. • Run a lessons-learned session after each exercise and feed outcomes into runbook and plan updates. • Review the DR plan at least annually and after any major change in the environment. • Report DR readiness, exercise results and open findings to leadership and to the customer risk and compliance teams. • Prepare the DR calendar for mainframe systems (GDPS region switch and Hyperswap tests). • Keep the DR runbook, DR plan (including backout), each team\'s DR checklist and the stakeholder list updated. • Before the DR exercise, initiate communication with all stakeholders (infrastructure and applications), including leadership. • Before the DR exercise, schedule a weekly or bi-weekly interlock to fix all logistics. • Before the DR exercise, raise the DR change well before lead time and chase all approvals until ready. • Lead the bridge call during the DR test and facilitate the DR activities until applications testing is successful. • Track all issues reported and their timelines. • Support the infrastructure and application teams with coordination and communication. • Capture the regulatory evidence for the defined RTO and RPO. • Prepare a detailed report with RTO and RPO evidence, findings and the action owner for each finding. • Follow up closely with finding owners and drive remediation, ensuring all findings are closed before the next DR exercise. Risk, compliance and audit management • Score and track risks, assign owners and treatment plans, and report risk trends to leadership. • Track policy exceptions and control deviations until closure or formal acceptance. • Map regulatory requirements to mainframe controls and keep the control inventory current. • Track regulatory changes in Canada and Europe and assess their impact on the mainframe environment, with architects. • Support third-party and service provider risk assessments for mainframe vendors, including the information regulators require on those arrangements. • Support incident reporting and post-incident reviews where regulation sets reporting expectations. • Report on patching and vulnerability remediation status as compliance evidence. • Define and track audit and compliance metrics, such as open findings, ageing and on-time closure. • Retain audit evidence as required by regulators and internal policy. • Own and maintain the risk register for all tracks. • Run periodic access reviews (privileged IDs, offboarded employees, system IDs) and publish the report. • Organize periodic internal audits as per the schedule, capture gaps and follow up until remediation. • Own and maintain the compliance requirements based on regulatory standards (OSFI, PIPEDA and DORA). • Own the implementation of any security controls required from a compliance perspective. • Act as the single point of contact for internal and external audits. • Establish the template for the audit evidence pack and keep it updated as per regulators\' requirements. • Coordinate with the respective teams to gather audit responses within the agreed SLA. Job Summary : This role has two parts. As DR Coordinator, it plans, runs and closes out the mainframe disaster recovery exercise (GDPS region switch), including the regulatory evidence for RTO and RPO. As Risk & Compliance Management, it manages the mainframe risk register, access reviews, internal and external audits, and compliance with regulatory standards. Key Responsibilities NA Skill Requirements Skill Requirement : • Experience coordinating DR exercises for mainframe environments, with working understanding of GDPS and the concepts of RTO and RPO. • Experience with change management and stakeholder coordination across infrastructure and application teams, including leadership. • Experience supporting internal and external audits, including evidence preparation and finding remediation. • Familiarity with regulatory expectations for financial institutions and insurers, such as OSFI guidelines (for example B-13 on technology and cyber risk, B-10 on third-party risk and E-21 on operational risk and resilience), PIPEDA, DORA (Regulation (EU) 2022/2554), GDPR and Solvency II. • Working knowledge of access management and mainframe security controls at the level needed to run and review access reviews. • Strong written reporting skills for DR reports, risk reporting and audit responses. • Preferred certifications: ITIL, CISA, CRISC, ISO 27001, or a business continuity certification such as CBCP or MBCI. Other Requirements NA Apply now Information at a Glance Why HCLTech? At HCLTech, you'll supercharge your potential. You'll find your career. And you'll find your spark. All at a place that knows that helping its customers stay on top starts by putting its people first. HCLTech is a global technology company, home to more than 230,000 people across 60 countries, delivering industry-leading capabilities centered around digital, engineering, cloud and AI, powered by a broad portfolio of technology services and products. We work with clients across all major verticals, providing industry solutions for Financial Services, Manufacturing, Life Sciences and Healthcare, Technology and Services, Telecom and Media, Retail and CPG, and Public Services. Consolidated revenues as of 12 months ending September 2026 totaled $14.8 billion. Disclaimer Privacy Statement Terms of use Sitemap Raise a Grievance We use cookies on our site. Please read more about cookies policy here. Opens in a new tab. Opens in a new tab. Opens in a new tab. Opens in a new tab. Opens in a new tab. Opens in a new tab. Copyright © 2026 HCL Technologies Limited Cookie Consent Manager When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. Because we respect your right to privacy, you can choose not to allow some types of cookies. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer. Required Cookies These cookies are required to use this website and can't be turned off. Required Cookies Required Cookies Provider Description Enabled SAP as service provider We use the following session cookies, which are all required to enable the website to function: "route" is used for session stickiness "careerSiteCompanyId" is used to send the request to the correct data center "JSESSIONID" is placed on the visitor's device during the session so the server can identify the visitor "Load balancer cookie" (actual cookie name may vary) prevents a visitor from bouncing from one instance to another Cookies from provider SAPasserviceprovider are required and cannot be turned off Functional Cookies These cookies provide a better customer experience on this site, such as by remembering your login details, optimizing video performance, or providing us with information about how our site is used. You may freely choose to accept or decline these cookies at any time. Note that certain functionalities that these third-parties make available may be impacted if you do not accept these cookies. Consent to all Functional Cookies Functional Cookies Provider Description Enabled Vimeo Vimeo is a video hosting, sharing, and services platform focused on the delivery of video. Opting out of Vimeo cookies will disable your ability to watch or interact with Vimeo videos. Cookie Policy Privacy Policy Terms and Conditions Consent to cookies from provider Vimeo YouTube YouTube is a video-sharing service where users can create their own profile, upload videos, watch, like, and comment on videos. Opting out of YouTube cookies will di