Technology Risk Management

The Vice President, Technology Risk Manager will be a part of the Technology Risk Management (TRM) team within the Second Line of Defense (2LOD), supporting the delivery of risk management over IT Operations, Development, and Governance. This role entails overseeing governance and compliance activities for the Technology Risk function, including policy maintenance, 2LOD control testing, and the preparation of reports for relevant governance committees. The position directly supports the Chief Information Security Officer in the day-to-day operations of the Technology Risk function

Essential duties and responsibilities

1. Policy Enhancement:

   • Enhance Technology Risk policies and related documentation for the U.S. platform.

   • Review local policies to ensure appropriate quality, ownership, coverage, and implementation.

   • Support the development of Policy and Procedure documentation to address gaps in the existing policy framework.

2. Risk Management and Control Testing:

   • Conduct Technology Risk Assessments and drive mitigation actions.

   • Perform periodic Technology Risk control testing to ensure appropriate oversight of the First Line of Defense (1LOD).

   • Update and maintain results within the firm’s Governance, Risk, and Compliance (GRC) tool.

   • Track and follow up on Audit and Regulatory recommendations and findings.

3. Risk Reporting:

   • Provide administrative support for TRM monthly governance committees and other senior management meetings and presentations, as necessary.

   • Coordinate documentation gathering for internal and external audits, as well as regulatory examinations.

   • Conduct data analysis and mining required for Head Office and local Key Risk Indicator (KRI) and Key Performance Indicator (KPI) reporting.

4. Training and Awareness Program:

   • Develop and support Information and Cyber Security training programs for employees, including weekly Information Security awareness sessions for new joiners.

   • Assist in the development and support of platform-wide phishing campaigns and targeted spear-phishing initiatives.

Qualifications

• Bachelor’s degree in Business, Computer Science, Information Security, or a related field.
• 5+ years of experience in Technology Risk or Information Security.
• Previous experience in related areas, such as Information Security and IT Risk & Control functions, is required.
• Prior exposure to industry frameworks (e.g., NIST, COBIT, FFIEC) and regulations (e.g., NY DFS500, EBA/GL/2019/04, NFA).
• Strong technical problem-solving and data analytical skills.
• Proven experience writing clear and accurate content for internal publications, such as training materials, bulletins, and memos.
• Effective teamwork, communication, collaboration, and relationship-building skills.
• Ability to operate across IT functions (U.S., Head Office, and other geographies).
• Strong sense of ownership and drive.
• Excellent organizational, time management, and prioritization skills.
• Certification (or working towards) in CISSP, CISA, CISM, CRISC, or CIA is a plus.
• Strong communication and interpersonal skills, with the ability to engage with employees at all levels, including other geographical platforms.
• Detail-oriented manager with a strong working knowledge of program, portfolio, and project management techniques, processes, and methodologies.
• Ability to work independently while collaborating effectively in teams.
• High degree of integrity and a strong work ethic.
• Commitment to timely follow-through on commitments.
• Capability to navigate and work across departments while understanding and anticipating their constraints.
<