IT GRC and Resilience Manager

About Ashurst

To find out more please visit www.ashurst.com.

Department/Role overview

The IT GRC and Resilience Manager will be responsible for the strategy and programme delivery to drive an improved risk management culture across IT. This will include the implementation of an IT policy framework, risk management methodology/processes/tools and standardised governance methods.

This role will also act as an advisor on risk posture and control effectiveness across IT and support the firm's clients in understanding our risk and control effectiveness.

Main responsibilities

This role is responsible for following key areas in the Global Information Technology function of Ashurst:

• Define and implement a technology risk policy and framework that aligns to the business and IT risk appetite.
• Own and manage an IT Risk Register with appropriate governance processes aligned to firm wide risk management.
• Implement a 1st line of defence assessment programme to determine control effectiveness.
• Provide oversight and tracking of open risk remediation, including external client audit findings.
• Implement processes and technology solutions to improve management of risk across the firm.
• Ensure Technology risk is aligned to the Ashurst enterprise and operational risk framework.

• Implement, maintain and continually refine a governance framework across Global IT.
• Manage and monitor all IT policies ensuring that they have ownership, are updated/reviewed regularly and clearly communicated.
• Monitor, measure and report across the information technology risk and control landscape.
• Identify any trends that may require further action e.g. improved change control, further PMO controls etc.
• Implement standard documentation/processes and drive their adoptions across Global IT.
• Support process owners to prepare procedures to underpin the approved policies.

• The IT relationship manager for client information technology requirements, including audit, contract renewal and new technology implementation.
• Act as a trusted advisor on information technology risk related activities, processes, policies and procedures across the firm and its client base.
• Ensure that information technology risk advice is aligned with business and client needs and requirements.

• Maintain the Disaster Recovery Strategy/Programme for Ashurst globally in order to ensure that all business IT applications are protected in the event of disruption and business continuity protected.
• Manage and continuously improve the disaster recovery governance framework, aligned to the organisations risk management framework, including standardising documentation, streamlining process and managing exceptions.
• Maintain an annual testing schedule with up to date information, including but not limited to, Recovery Time Objectives (RTO), Recovery Point Objectives (RPO) and tracking of gaps/issues.
• Oversight of all back-up and recovery procedures to ensure they are fit for purpose.
• Work with the Business Continuity team to review and maintain Business Impact Analysis (BIA) documentation, ensuring this provides clear guidance on disaster recovery processes and attainability.
• Implement and maintain regular management reporting on the current state of Disaster Recovery provision across the organisation, benchmarking recovery performance against critical service levels and KPIs identifying service exceptions and areas for improvement/development.
• Improve awareness of disaster recovery across the organisation, including improved training and education for business and technology stakeholders.
• Act as the single point of contact for all client, audit and internal stakeholder requests for Disaster Recovery, including the provision of evidence.
• Provide subject matter expertise in disaster recovery to projects and changes implemented in the organisation, including establishing governance around the addition of new applications/services.

• Liaise and work closely with the Information Security Group and the Information Security Team across the firm.
• Manage the delivery of global programmes as assigned.
• Other tasks as assigned.
• Risk and Control: Ensure that all activities and duties are carried out in full compliance with our regulatory requirements and internal policies.

• Thorough understanding and demonstrated experience of Information Technology risk, resilience and information security.
• Industry certified such as CISSP, CISM and/or CRISC.
• General understanding of COBIT.
• Ability to work with and across all support functions in the firm.
• Excellent analytical skills.
• Excellent written and communication skills.
• Good networking skills.
• Client focused - able to listen to, understand and respond to client requirements.
• Able to operate within a project brief.
• Awareness/exposure to different software development life cycles and methods.
• Produce high level solutions/approaches, requiring systems analysis and design skills.
• High level of familiarity with MS office as a production tool.
• Liaise with colleagues in Risk and Compliance and management generally to assist with research and evaluation of software solutions from 3rd party suppliers and production of necessary deliverables such as tender documents, liaising with suppliers.
• Able to manage small projects from inception to delivery.
• Full project lifecycle experience.
• Detail oriented with an ability to work accurately and efficiently even when under pressure.
• Uses initiative
• 'can do' approach
• ability to complete set tasks with minimal supervision.
• Tactful and diplomatic when in pressured situations.

• Working within a structured project framework.
• Knowledge of legal sector and current risks.
• Familiar with ITIL, Prince 2, Agile, ISO 2700 suite.

Background checks

These checks are only undertaken with consent, and in accordance with our legal and regulatory obligations.