Senior Engineer– Digital Risk Management

Position Title: Senior Engineer– Digital Risk Management (P3)

Location: Bangalore / Hyderabad

Reports To: Associate Manager, Digital Risk Management - Carrier Global Capability Center (GCC), Digital Team

Position Summary: To lead the identification, assessment, management, and governance of IT risks across Carrier’s enterprise environment. This role is critical to ensuring the resilience of IT services and the integrity of Carrier's information assets by embedding a robust IT risk management framework aligned with global standards and Carrier's strategic goals. This role acts as the strategic owner of risk governance while working closely with IT Risk Analysts who are responsible for day-to-day execution and operationalization of controls, assessments, and reporting, with close coordination and frequent interaction across internal subject-matter-expert (SME) teams and Risk owners to ensure risk management process is followed.

Key Responsibilities:

1. IT Risk Governance & Framework Management

• Design, implement, and maintain the IT Risk Management Framework aligned with Carrier based Digital Risk Framework which is derived from NIST CSF and ISO 27001.

• Define IT risk taxonomy, thresholds, and escalation protocols for consistent enterprise-wide adoption.

• Serve as the primary liaison for IT risk matters across Carrier's global business units, infrastructure, and application teams.

• Serve as the primary record creator for risks in ServiceNow GRC application.

Key person contributing to the design, configuration, and rollout of the ServiceNow GRC framework, covering the Policy, Risk, Issue, Compliance and Exception Management modules end-to-end.

1. Risk Identification, Assessment & Prioritization

• Conduct and oversee IT risk assessments (inherent and residual) across critical applications, infrastructure, and projects.

• Guide IT Risk Analysts in executing risk analysis, evidence collection, and scoring processes.

• Facilitate scenario-based and targeted risk assessments for high-impact areas including cloud migrations, system upgrades, and M&A.

• Maintain and update risk registers, scoring models, and risk heatmaps using GRC tools - ServiceNow IRM

1. Control Management & Monitoring

• Define and implement key risk indicators (KRIs) and key control indicators (KCIs) for ongoing risk monitoring.

• Supervise IT Risk Analysts in evaluating control effectiveness and documenting evidence.

• Develop action plans for control deficiencies, monitor remediation, and report control maturity metrics.

1. Exception & Deviation Handling

• Lead the end-to-end management of risk exceptions, waivers, and deviations from IT policy.

• Oversee the workflows managed by analysts and ensure that exceptions are timely reviewed and approved by appropriate stakeholders.

• Automate exception workflows and integrate them with CMDB and audit logs for traceability.

1. Stakeholder Engagement & Risk Reporting

• Prepare and present monthly/quarterly risk dashboards to senior leadership, Risk Council, and DCC.

• Conduct regular stakeholder sessions to capture risk concerns, share insights, and promote risk ownership.

• Provide risk insights to inform IT strategic decisions, budget allocations, and project prioritization.

1. Awareness, Training & Culture Building

• Develop and deliver IT risk training modules to application owners, support teams, and project managers.

• Promote a risk-aware culture through playbooks, campaigns, and collaborative learning sessions.

• Partner with HR and L&D to integrate IT risk content into employee training journeys.

• Mentor and coach IT Risk Analysts to build operational maturity and grow internal expertise.

Qualifications:

• Bachelor's Degree in Computer Science, or related field.

• Minimum 8-10 years in IT risk management, audit, or cyber governance.

• Strong knowledge of risk frameworks (NIST, ISO 27001, COBIT), internal controls, and security policies.

• Hands-on experience with GRC platforms, specifically ServiceNow IRM / GRC (Risk, Issue, and Exception Management modules), RSA Archer or any other platforms.

• Demonstrated ability to coordinate and interact frequently with internal SME teams and external stakeholders to drive risk topics and strengthen the risk management portfolio.

• Working knowledge of AI risk frameworks (NIST AI RMF, ISO/IEC 42001) and hands-on ability to leverage AI tools — including building lightweight risk-reporting apps, dashboards, or chatbots — to automate risk triage, scoring, monitoring and stakeholder queries.

Certifications (Preferred):

• CRISC.

Key Attributes:

• Strategic thinking with tactical execution.

• Strong interpersonal, influencing, and negotiation skills.

• Analytical mindset with the ability to simplify complex risk narratives for business audiences.

• Proven ability to lead cross-functional teams and manage multi-country risk engagements.

• Strong coordination skills, with the ability to build and maintain effective working relationships across internal SME teams and external stakeholders for effective risk management outcomes.

Why Join Us? At Carrier, you will be part of a world-class, diverse workforce that is driving innovation and creating solutions that matter. This role provides an exciting opportunity to shape the future of communications at Carrier Digital, offering high visibility and strategic influence within the organization.

Carrier is An Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or veteran status, age or any other federally protected class.

Job Applicant's Privacy Notice:

Click on this link to read the Job Applicant's Privacy Notice