Senior Specialist, Technology Risk Management

Job Description

The Opportunity

• Based in Hyderabad, join a global healthcare biopharma company and be part of a 130- year legacy of success backed by ethical integrity, forward momentum, and an inspiring mission to achieve new milestones in global healthcare.

• Be part of an organisation driven by digital technology and data-backed approaches that support a diversified portfolio of prescription medicines, vaccines, and animal health products.

• Drive innovation and execution excellence. Be a part of a team with passion for using data, analytics, and insights to drive decision-making, and which creates custom software, allowing us to tackle some of the world's greatest health threats.

Our Technology Centers focus on creating a space where teams can come together to deliver business solutions that save and improve lives. An integral part of our companys’ IT operating model, Tech Centers are globally distributed locations where each IT division has employees to enable our digital transformation journey and drive business outcomes. These locations, in addition to the other sites, are essential to supporting our business and strategy.

A focused group of leaders in each Tech Center helps to ensure we can manage and improve each location, from investing in growth, success, and well-being of our people, to making sure colleagues from each IT division feel a sense of belonging to managing critical emergencies. And together, we must leverage the strength of our team to collaborate globally to optimize connections and share best practices across the Tech Centers.

Role Overview

We are seeking a highly analytical, technically proficient, and business-oriented Business Technology Risk Specialist to join our Business Technology Risk (BTR) organization.

This role sits at the intersection of technology, cybersecurity, risk management, and business enablement. The successful candidate will serve as a trusted advisor to technology leaders, business stakeholders, and cybersecurity teams by identifying, assessing, and communicating technology risks associated with applications, infrastructure, cloud services, AI solutions, third-party vendors, and strategic technology initiatives.

The role requires strong expertise in vendor risk management, application security risk, technology architecture reviews, security controls assessment, IT risk assessments, and risk governance, along with the ability to translate complex technical findings into concise executive insights that support risk-based decision making by senior leadership and the CISO organization.

What You Will Do

Technology Risk Assessments

• Conduct end-to-end technology risk assessments across applications, infrastructure, cloud platforms, data platforms, AI/ML solutions, and third-party services.

• Evaluate inherent, residual, and emerging risks associated with new technologies and business initiatives.

• Assess technology implementations against corporate security standards, risk management requirements, and regulatory expectations.

• Facilitate risk identification workshops with business and technical stakeholders.

• Develop risk scenarios, risk statements, impact assessments, and treatment recommendations.

Third-Party & Vendor Risk Management

• Lead technical due diligence reviews for vendors, suppliers, SaaS providers, managed service providers, and cloud service providers.

• Assess security architecture, data flows, application designs, integrations, and hosting environments of third-party solutions.

• Review SIG questionnaires, security assessments, penetration test reports, SOC reports, audit reports, and vendor security documentation.

• Identify control gaps and determine appropriate risk ratings and treatment strategies.

• Advise business owners on vendor onboarding risks, compensating controls, and residual risk acceptance considerations.

• Support ongoing monitoring of high-risk vendors and critical third-party relationships.

Application & Technology Risk Analysis

• Assess risks associated with enterprise applications, APIs, integrations, identity services, cloud-hosted workloads, and business platforms.

• Evaluate application architecture against secure design and security engineering principles.

• Review authentication, authorization, session management, encryption, secrets management, logging, monitoring, and resilience controls.

• Analyze technical findings from: Penetration tests Red team exercises Vulnerability assessments Architecture reviews Threat modeling engagements Cloud security assessments

• Identify root causes and recommend practical remediation actions.

Security Control Evaluation

• Assess design and operating effectiveness of technology and cybersecurity controls.

• Evaluate preventive, detective, corrective, and compensating controls.

• Validate effectiveness of: Identity & Access Management (IAM) Privileged Access Management (PAM) Endpoint Security Vulnerability Management Network Security Logging & Monitoring Data Protection Controls Disaster Recovery & Business Resilience Cloud Security Controls

• Support control maturity assessments and continuous improvement initiatives.

Risk Governance & Advisory

• Maintain risk registers and document technology risks in accordance with enterprise risk management processes.

• Facilitate risk discussions with technology teams, security engineers, architects, auditors, and leadership.

• Challenge assumptions and validate evidence supporting risk decisions.

• Ensure risks are accurately documented, quantified, escalated, and tracked through resolution.

• Support risk acceptance and remediation approval processes.

Executive Communication & CISO Advisory

• Translate complex technical findings into clear business risk language.

• Develop executive-level risk summaries, dashboards, briefings, and presentations.

• Provide concise insights on: Risk trends Emerging threats Control effectiveness High-risk vendors Strategic technology initiatives

• Support CISO, senior leadership, and risk committees with risk-informed recommendations and decision support.

• Present risk outcomes and mitigation strategies to executive stakeholders with confidence and credibility.

Strategic Risk Enablement

• Monitor evolving threat landscapes, attacker techniques, and emerging technology risks.

• Provide risk advisory for strategic transformation initiatives including: Cloud modernization AI/Generative AI adoption Digital transformation programs Large-scale platform migrations Mergers, acquisitions, and integrations

• Partner with architecture, engineering, compliance, and cybersecurity teams to embed risk considerations early in the solution lifecycle.

Primary Skills:

The ideal candidate should possess working knowledge across the following domains:

Application Security

• Secure SDLC

• OWASP Top 10

• API Security

• Authentication & Authorization

• Secrets Management

• Data Protection

• Threat Modeling

Cloud Security

• AWS

• Azure

• SaaS Security

• Cloud Security Posture Management

• Identity and Federation

• Container & Kubernetes Security

Infrastructure Security

• Operating Systems

• Active Directory

• Network Architecture

• Segmentation

• Endpoint Security

• Vulnerability Management

Risk & Governance

• IT Risk Assessments

• Control Assessments

• Risk Treatment Planning

• Risk Acceptance Frameworks

• Risk Registers

• Governance Processes

Secondary Skill:

Third-Party Risk

• SIG Framework

• SOC Reports

• Vendor Security Assessments

• Third-Party Due Diligence

• Supply Chain Risk

• Vendor Continuous Monitoring

What Should You Have:

Required Qualifications

• Bachelor's degree in Information Technology, Computer Science, Cybersecurity, Engineering, or related discipline.

• 5+ years of experience in Technology Risk Management, Cybersecurity, IT Audit, Third-Party Risk Management, Security Architecture, or related disciplines.

• Strong experience conducting technology and cybersecurity risk assessments.

• Experience assessing third-party vendors, cloud providers, and supplier-hosted solutions.

• Strong understanding of enterprise applications and technology architectures.

• Demonstrated ability to identify control gaps and articulate business impacts.

• Experience developing risk treatment plans and remediation recommendations.

• Excellent written, verbal, and presentation skills.

• Ability to communicate effectively with both technical teams and executive leadership.

Preferred Qualifications

• Professional certifications such as: CISSP CISM CRISC CISA AWS Security Specialty Azure Security Engineer

• Experience in pharmaceutical, healthcare, or regulated industries.

• Familiarity with AI/GenAI risk assessments.

• Experience supporting executive risk committees or CISO organizations.

• Experience with Archer, ServiceNow GRC, ARAVO, OneTrust, or similar risk platforms

Who we are

We are known as Merck & Co., Inc., Rahway, New Jersey, USA in the United States and Canada and MSD everywhere else. For more than a century, we have been bringing forward medicines and vaccines for many of the world's most challenging diseases. Today, our company continues to be at the forefront of research to deliver innovative health solutions and advance the prevention and treatment of diseases that threaten people and animals around the world.

What we look for

Imagine getting up in the morning for a job as important as helping to save and improve lives around the world. Here, you have that opportunity. You can put your empathy, creativity, digital mastery, or scientific genius to work in collaboration with a diverse group of colleagues who pursue and bring hope to countless people who are battling some of the most challenging diseases of our time. Our team is constantly evolving, so if you are among the intellectually curious, join us-and start making your impact today.

Required Skills:

Preferred Skills:

Current Employees apply HERE

Current Contingent Workers apply HERE

Secondary Language(s) Job Description:

#MSDHYDIT

Search Firm Representatives Please Read Carefully

Merck & Co., Inc., Rahway, NJ, USA, also known as Merck Sharp & Dohme LLC, Rahway, NJ, USA, does not accept unsolicited assistance from search firms for employment opportunities. All CVs / resumes submitted by search firms to any employee at our company without a valid written search agreement in place for this position will be deemed the sole property of our company. No fee will be paid in the event a candidate is hired by our company as a result of an agency referral where no pre-existing agreement is in place. Where agency agreements are in place, introductions are position specific. Please, no phone calls or emails.

Employee Status:

Relocation:

VISA Sponsorship:

Travel Requirements:

Flexible Work Arrangements:

Shift:

Valid Driving License:

Hazardous Material(s):

Job Posting End Date:

*A job posting is effective until 11:59:59PM on the day BEFORE the listed job posting end date. Please ensure you apply to a job posting no later than the day BEFORE the job posting end date.