IT Operational Resilience Manager

<b>Overview</b><br><div><p><span style="font-family:arial, helvetica, sans-serif">Are you passionate about digital operational resilience, technology operations, and cybersecurity in a regulated environment? This is a unique opportunity to help build and operate the technology control environment for Microsoft Ireland Payment Services Limited (MIPSL), a regulated Payments Institution based in Dublin. </span></p></div><div><p><span style="font-family:arial, helvetica, sans-serif">Microsoft is on a mission to empower every person and every organization on the planet to achieve more. Our culture is centered on embracing a growth mindset, inspiring excellence, and encouraging teams and leaders to bring their strengths each day. The Senior IT Operations, Security and DORA Specialist will play a key role in building and operating MIPSL’s technology controls and Digital Operational Resilience Act (DORA) compliance capabilities. Working closely with the Chief Information Officer and IT Operational Resilience Manager, you will apply your DORA and technology expertise to translate regulatory requirements into practical processes, controls and evidence. You will also provide hands-on operational oversight across IT services, security, identity and access, vulnerability management, technology assets, change, data controls, and outsourced technology services. This is an individual contributor role requiring strong DORA expertise, technology risk and control experience, and the ability to work effectively with Microsoft service teams and third-party providers in a regulated environment. </span></p></div><br><br><b>Responsibilities</b><br><div><div><p><span style="font-family: arial, helvetica, sans-serif;">Build and operate DORA compliance </span></p></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Act as a DORA subject matter expert, supporting the implementation and continuous improvement of MIPSL’s DORA compliance framework. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Translate DORA requirements into practical technology processes, controls, procedures and evidence. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Perform and support DORA gap assessments, control assessments and readiness reviews, coordinating remediation through to closure. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Support ICT risk management, incident management, digital operational resilience testing, and ICT third-party risk-management activities. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Maintain DORA policies, procedures, control documentation and evidence in partnership with accountable stakeholders. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Support regulatory reporting, audits, assurance activities and Central Bank of Ireland information requests. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Monitor regulatory developments and help embed evolving requirements into MIPSL’s technology environment. </span></p></li></ul></div><div><p><span style="font-family: arial, helvetica, sans-serif;">Operate IT service and security controls </span></p></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Monitor IT services delivered by Microsoft teams and third-party providers, including availability, performance, incidents, problems, capacity and service levels. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Operate and monitor controls across incident, problem, change, configuration, asset and service management. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Review security events, control performance and material technology issues, coordinating remediation and escalation where required. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Obtain and assess evidence that security and operational controls are operating effectively. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Monitor technology changes to ensure appropriate testing, approval, security and operational-readiness requirements are met. </span></p></li></ul></div><div><p> </p></div></div><div><div><p><span style="font-family: arial, helvetica, sans-serif;">Support identity, vulnerability and asset management </span></p></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Coordinate identity and access controls, including provisioning, removal, privileged access and periodic access reviews. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Monitor vulnerability, patching and configuration-management performance and track remediation against agreed requirements. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Maintain oversight of MIPSL’s ICT asset inventory, including ownership, classification, lifecycle status and key dependencies. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Support mapping between technology assets, business processes, data, service providers and critical dependencies. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Identify control or information gaps and coordinate remediation with accountable service owners. </span></p></li></ul></div><div><p><span style="font-family: arial, helvetica, sans-serif;">Support technology controls for data, governance and privacy</span></p></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Support implementation of technology controls for data access, protection, secure storage, retention and secure deletion. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Support data classification and identification of critical business data. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Obtain and review evidence that Microsoft and third-party providers are operating required technology controls. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Track technology-related data-control issues and coordinate remediation with business, Privacy, Legal and Compliance stakeholders. </span></p></li></ul></div><div><p><span style="font-family: arial, helvetica, sans-serif;">Support outsourced technology oversight and assurance </span></p></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Monitor operational and security controls delivered by Microsoft group entities and third-party technology providers. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Review service performance, control evidence, risks, issues, exceptions and remediation plans. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Support technology due diligence, ICT third-party risk assessments, service reviews and assurance activities. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Maintain evidence demonstrating effective oversight of outsourced technology services. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Support internal and external audit, regulatory reviews and technology-control assessments. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Produce technology, security and DORA metrics and reporting for management and relevant governance committees. </span></p></li></ul></div></div><br><br><b>Qualifications</b><br><div><p><strong><span style="font-family: arial, helvetica, sans-serif;">Required Qualifications </span></strong></p></div><div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Bachelor’s Degree in Computer Science, Information Technology, Engineering, Cybersecurity, Risk Management, Business, or a related field AND experience in IT operations, cybersecurity, technology risk, IT service management or a related technology-control role, OR equivalent experience. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Strong knowledge of the EU Digital Operational Resilience Act (DORA), including ICT risk management, ICT incident management, resilience testing and ICT third-party risk management. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Experience translating regulatory or risk requirements into practical technology processes, controls and evidence. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Experience with IT operations and technology controls, including IT service management, identity and access management, vulnerability management, security operations or technology asset management. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Experience supporting regulatory compliance, control assessments, audit, assurance or remediation activities. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Strong stakeholder-management and communication skills, with the ability to work effectively across business, technology, risk and compliance teams. </span></p></li></ul></div><div><p><strong><span style="font-family: arial, helvetica, sans-serif;">Preferred Qualifications </span></strong></p></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Experience implementing or operating DORA requirements within financial services, payments, banking or fintech. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Experience working within a regulated entity that relies on group or third-party technology services. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Knowledge of Central Bank of Ireland and European Banking Authority requirements relating to ICT risk, operational resilience and outsourcing. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Knowledge of technology and control frameworks such as ITIL, COBIT, ISO 27001, ISO 22301 or NIST. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Experience supporting regulatory inspections, audits or technology-control assurance. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Relevant certification in information security, technology risk, IT service management, audit, governance or operational resilience. </span></p></li></ul></div><div><ul style="list-style-type: disc;"><li style="font-family: arial, helvetica, sans-serif;"><p><span style="font-family: arial, helvetica, sans-serif;">Ability to work independently, apply regulatory requirements pragmatically and drive issues through to resolution in a complex technology environment. </span></p></li></ul></div><div><p> </p></div></div> <br><br><p>Technical Program Management IC3 - The typical base pay range for this role across Ireland is € 63,400.00 - € 105,700.00 per year. Certain roles may be eligible for benefits and other compensation. </p><p></p> <p>Find additional benefits and pay information here:<br><a href="https://careers.microsoft.com/v2/global/en/corporate-pay/ireland-corporate-pay.html">https://careers.microsoft.com/v2/global/en/corporate-pay/ireland-corporate-pay.html</a></p><br><p>This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.</p><br><hr><br><p>Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about <a href="https://careers.microsoft.com/v2/global/en/accessibility.html"><b><u>requesting accommodations.</u></b></a></p>