Summary
Overview
Work History
Education
Skills
Certification
Timeline
Hi, I’m

Biju Nair

Biju Nair

Summary

Highly Skilled and results driven risk management professional with more than 15 years of experience in developing and implementing risk management process, policies and practices across multiple business units (Upstream and Downstream). 

Proven track record in identifying and evaluating potential risks and implementing risk mitigation strategies. Exceptional skills in risk analysis, assurance, compliance monitoring and control testing collaborating with internal and external stakeholders to achieve the organization risk objectives.


Overview

21
years of professional experience
1
Certificate

Work History

Shell

Senior Risk and Controls Advisor
07.2022 - Current

Job overview

1. As the Functional Lead (currently leading Mobility, Chemicals and Products and Shell Energies within Downstream) for security across Business Units, I ensure key projects are delivered securely and on time.

2. Conducted regular risk assessments and control testing to ensure compliance with internal policies, industry regulations, and best practices

3. Advised senior management on strategic decisions by providing in-depth analysis of potential risks and recommended control measures

4. Led cross-functional teams to enhance the organization's risk management culture and promote a proactive approach to identifying and addressing risks

5. Within the IRM team, I have acted as the Senior Risk and Controls Advisor for both the Upstream (including Projects and Technology, Sub Surface and Wells, C&P, and Safety and Environment) and Downstream (comprising Mobility, Chemicals & Products, and Shell Energy) sectors.

6. I performed an in-depth analysis of Shell's data exposure during the MoveIT file transfer incident, ensuring all information assets were adequately assessed from a security perspective.

7. I was instrumental in developing the organization's authentication policy.

8. I ensure that risks to information assets are identified and communicated to relevant stakeholders, with appropriate controls implemented to mitigate these risks.

9. I assume considerable personal responsibility and autonomy in addressing complex problems and tasks, thoroughly investigating, defining, and resolving complex issues.

10. My role entails teamwork and interaction with business leaders, driving essential initiatives from inception to completion to achieve the intended results.

11. I assist in conducting risk-based security assessments for IT projects, including those involving networks, communication, hosting, storage, cloud services, and end-user computing, to ensure compliance with the necessary security architecture and design principles.

12. I oversee IT project evaluations, guiding them towards stage gate approvals to guarantee the provision of secure, dependable, and compliant IT solutions.

13. I work with IT infrastructure project managers, portfolio owners, service managers, and other stakeholders to identify and coordinate.

Deloitte Touche Tohmatsu LLC

Manager-Cyber Risk
06.2019 - 07.2022

Job overview

  • Serve as a functional specialist in IT Information Risk Management (IRM) for a large European Oil and Gas major in the role of Senior Risk and Controls Advisor, for both application and infrastructure initiatives.
  • Support the execution of risk-based security assessments for IT projects, including those related to networks, communication, hosting, storage, cloud services, and end-user computing, ensuring adherence to required security architecture and design principles.
  • Actively evaluate information security risks, threats, vulnerabilities, and compliance with legal, regulatory, and Payment Card Industry (PCI) standards.
  • Conduct IT project reviews, steering projects toward stage gate approvals to ensure the delivery of secure, reliable, and compliant IT solutions.
  • Collaborate with IT infrastructure project managers, portfolio owners, service managers, and other stakeholders to identify and communicate IT security risks, select suitable IT controls, and implement risk mitigation strategies and IT controls within the project.
  • Provide support for business risk assessments of applications, IT setups, and project solutions in defined areas, aiding IRM in the application of the IT Control Framework.
  • Aid IT operations in developing and monitoring action plans based on findings, which includes analysis, reporting, and documentation.
  • Evaluate suppliers prior to onboarding to confirm their compliance with organizational security standards and facilitate the execution of TPRM activities for a European Oil and Gas Conglomerate.
  • Possess strong experience in Stakeholder Management, team leadership, and Project management.
  • Demonstrate proficiency in risk assessment, interpretation, analytical thinking, and negotiation skills.

National Stock Exchange of India Limited

Deputy Manager
06.2014 - 02.2019

Job overview

  • Successfully implemented ISO 27000 across business functions.
  • Established ITIL and SDLC processes for the organization and implemented the Quality Management System.
  • Orchestrated and executed internal audits for major projects to guarantee timely and budget-friendly delivery.
  • Conducted semi-annual/annual ISO audits to ready the organization for certification.
  • Completed two LEAN projects employing the DMAIC methodology.
  • Rolled out CSAT throughout all departments within business functions.
  • Collaborated closely with senior leadership, including the CTO and CISO, to facilitate strategic decision-making.

Cognizant Technology Solutions

Associate Manager
10.2012 - 05.2014

Job overview

  • Lead the implementation of the Operations Maturity and Process Compliance Framework across various IT IS practice engagements, including key accounts.
  • Equip delivery teams with process best practices and assist in identifying opportunities for service improvement.
  • Aid delivery teams in developing continual service improvement themes, offering ongoing support and mentoring throughout the execution.
  • Guarantee that engagements comply with the ISO 20000 standard for the duration of their tenure.
  • Perform process health check assessments to enhance the effectiveness and efficiency of processes and assist delivery teams in addressing any deficiencies.

Atos

Quality Manager
07.2011 - 10.2012

Job overview

  • Plan and execute ISMS and ITSM Audits.
  • Act as the SPOC for SOX (ISAE 3402) audit within the Managed Services division.
  • Ensure the availability and completion of remediation plans from projects in response to audit findings, and monitor their resolution.
  • Communicate audit and compliance statuses to senior management and disseminate audit scores to international teams.
  • Play a key role in defining and implementing change management and capacity management processes for the business unit.
  • Implement Risk Management for the Service Line, including the documentation, reporting, and analysis of risks at the Unit level, and present them to management.
  • Organize and perform audits, assessments, and reviews of projects/processes, and engage in status meetings.
  • Oversee process maintenance, encompassing process measurement and reporting, aligned with established process KPIs

Siemens ITS

Quality Manager
09.2008 - 06.2011

Job overview

  • Plan and conduct ISMS Audits and ITSM Audits
  • Plan and conduct monthly process audits for all projects within the Business Unit
  • Instrumental in defining and implementing the change management process for the business unit.
  • Roll-out of Risk Management for Service Line. Recording, reporting and analysis of Unit level risks and reporting them to senior management

Siemens Information System Limited. Worli, Mumbai

Team Manager
04.2005 - 08.2008

Job overview

  • Team Manager for Service Desk function for a global clients
  • Monitor resource availability and execute service continuity plan.
  • Maintain service volume forecasting trends as input for capacity planning.

Wipro Technologies

Technical Facilitator (L2)
06.2003 - 12.2004

Job overview

  • Team Management
  • Quality Audits
  • Training and Mentoring

Education

University of Mumbai

Master of Business Administration - MBA from Systems
12-2002

University Overview

University of Mumbai

Bachelor of Commerce - BCom from Business/Commerce, General
12-2000

University Overview

University of Mumbai

High School Diploma from Business/Commerce, General
12-1997

University Overview

Skills

  • Risk Based Assurance
  • Control Design and Testing
  • IRM Process Definition
  • Risk Analysis
  • Vendor Risk Assessments
  • Driving Org Initiatives

Certification

ISO IEC 27001-2011 LA DNV


ISO IEC 22301-2013 LA BSI


ISO IEC 20000 LA DNV

Timeline

Senior Risk and Controls Advisor
Shell
07.2022 - Current
Manager-Cyber Risk
Deloitte Touche Tohmatsu LLC
06.2019 - 07.2022
Deputy Manager
National Stock Exchange of India Limited
06.2014 - 02.2019
Associate Manager
Cognizant Technology Solutions
10.2012 - 05.2014
Quality Manager
Atos
07.2011 - 10.2012
Quality Manager
Siemens ITS
09.2008 - 06.2011
Team Manager
Siemens Information System Limited. Worli, Mumbai
04.2005 - 08.2008
Technical Facilitator (L2)
Wipro Technologies
06.2003 - 12.2004
University of Mumbai
Master of Business Administration - MBA from Systems
University of Mumbai
Bachelor of Commerce - BCom from Business/Commerce, General
University of Mumbai
High School Diploma from Business/Commerce, General
Biju Nair