Secure Data Exchange Compliance SME

At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all. 

Job Title:
Secure Data Exchange Compliance SME    Rank: 
Supervising Associate    Location: 
GDS Kochi    
Job Summary:

Secure Data Exchange Compliance SME supports the Stay in Compliance Lead by managing compliance activities for the organisation’s data transfer infrastructure. The role focuses primarily on secure data transfer products including Signiant Media Shuttle, Progress MOVEit and IBM Sterling, helping to maintain secure, supported and compliant services across internal, client-facing and DMZ-hosted environments.

Working with Infrastructure Operations,Network, Information Security, Service Management, application owners and vendors, the role detects and assesses alerts and vulnerabilities, supports risk-based prioritisation and remediation, improves patching and compliance processes, and produces governance reporting. The position provides product-specific subject-matter expertise and clear escalation to the Stay in Compliance Lead, without owning the broader infrastructure compliance programme.

Job Description

•    Serve as the product-specific compliance SME for Secure Data Exchange services.
•    Maintain compliance visibility across Data Transfer products, including version, patch, support and lifecycle status.
•    Monitor vendor, security and operational alerts; identify vulnerabilities and compliance gaps affecting data transfer products.
•    Assess technical impact, affected versions, exploitability, workload criticality, exposure and business risk, and support risk-based prioritisation in line with agreed standards and SLAs.
•    Coordinate remediation of Data Transfer product vulnerabilities, unsupported versions, configuration weaknesses and lifecycle risks with engineering and operations teams.
•    Maintain compliance visibility for Signiant Media Shuttle, Progress MOVEit and IBM Sterling components, including application versions, patches, operating-system dependencies and vendor support status.
•    Understand end-to-end client data transfer architecture, including internal and external transfer workflows, DMZ components, gateways or proxies, firewalls, certificates, service accounts, authentication, encryption and network dependencies.
•    Assess controls for data in transit and at rest, external access, least privilege, logging, audit trails, file retention, malware scanning and segregation between internet-facing, DMZ and internal zones.
•    Review Signiant, Progress and IBM security advisories, release notes, known issues and prerequisites, and translate findings into clear remediation actions.
•    Track remediation actions, ageing, exceptions, dependencies and closure evidence, escalating material risk, unsupported versions or delivery delays to the Stay in Compliance Lead.
•    Support change, patching and upgrade activities by validating readiness, workload protection, maintenance sequencing, rollback plans, implementation evidence and post-remediation status.
•    Maintain compliance records covering platform and application currency, asset ownership, security findings, approved exceptions, certificates, external exposure and control evidence.
•    Prepare governance reports for the Stay in Compliance Lead, highlighting exposure, patch status, product risks, remediation progress and exceptions.
•    Improve vulnerability assessment, patch planning, alert handling, evidence collection, asset data quality and compliance reporting processes.
•    Support audits and control reviews and build effective working relationships across Server, Storage,Network, Security, Service Management and vendor teams within the governance direction set by the Stay in Compliance Lead.

Knowledge & Competencies Required:

•    Knowledge of secure managed file-transfer products, particularly Signiant Media Shuttle, Progress MOVEIt and IBM Sterling.
•    Understanding of client data transfer solutions and DMZ architecture, including secure gateways, proxies, reverse proxies, firewalls, load balancers, certificates, DNS, NAT, ports, protocols and internal-to-external trust boundaries.
•    Understanding of secure transfer protocols and controls, including SFTP, FTPS, HTTPS, encryption, authentication, service accounts, role-based access, logging, retention and auditability.
•    Understanding of vulnerability management, security alert handling, risk assessment, remediation SLAs, patch currency, configuration compliance and product lifecycle controls.
•    Ability to interpret vendor advisories, CVEs, severity scores, release notes and scan findings and translate them into prioritised technical actions.
•    Strong analytical and problem-solving skills, with attention to evidence quality, data accuracy, service availability and control traceability.
•    Experience improving data transfer product compliance processes through standardization, automation and measurable controls.
•    Clear written and verbal communication skills, with the ability to explain infrastructure and external data transfer risks to technical and non-technical stakeholders.
•    Ability to work independently as an SME, coordinate across teams and escalate appropriately within established governance.

Job Requirements:
Education:
Bachelor’s degree in Computer Science, Information Technology, Engineering or a related technical discipline, or equivalent relevant experience.

Experience:
Relevant experience supporting enterprise data transfer services, with demonstrated involvement in vulnerability remediation, patch and upgrade coordination, DMZ-hosted services, compliance reporting or infrastructure operations.

Certification Requirements:
Data transfer related certifications, network security, ITIL or information security certifications are advantageous but not mandatory.

EY | Building a better working world

EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets.

Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate.

Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today.