Overview:

M&T Bank is seeking an experienced Operational Risk Manager within the Technology and Cybersecurity Risk Oversight team.  This position is responsible for the development, management and oversight of the delivery of technology and cybersecurity second line risk management and oversight services in line with area policies, industry standards, and management expectations.  The individual will utilize their years of experience in first- or second-line technology and/or cybersecurity risk management or oversight roles to establish and maintain a second line Technology and Cybersecurity Risk Oversight Program to ensure activities remain effective at identifying and mitigating potential risks within first line management practices.  The position is responsible for advising senior and executive leadership as it relates to operational technology and cybersecurity risks with appropriate consideration for the audience and is expected to do so in a collaborative manner, with other risk partners, as applicable.  The position will be responsible for supporting the evolving landscape of the technology and cybersecurity risk management environment and be able to positively influence both internal and external personnel with the evolution of such changes.  The position requires the ability to function autonomously in the oversight and/or execution of one or more of the following activities in a manner that adheres to the expectations of the enterprise and operational risk management frameworks, as it evolves, and the expectations of key stakeholders, up to and including the Board:  identification, assessment, quantification, documentation, escalation, reporting, and communication of unmitigated technology and cybersecurity risks within the business and Technology division.  The individual is considered a technology and cybersecurity subject matter expert in the businesses or functions that they support.   Given its responsibilities, the position requires the establishment of relationships with senior level personnel to remain apprised of changes in the business, and to communicate and present emerging risks, changes to the regulatory landscape, and consideration of cost beneficial risk management enhancements for the business.   The position may have responsibility over members within the team, who will develop their skill sets under the guidance or direction of this individual.

Primary Responsibilities:

• Develop and implement a program that provides independent oversight and critical challenge to the First Line of Defense in the areas of identifying, assessing, monitoring, and controlling technology and cybersecurity risks. Be aware of and monitor emerging and ongoing risks for all pillars of risk identified in M&T’s Risk Appetite Statement.
• Provide effective oversight and challenge of the identification, assessment, monitoring, mitigation, and reporting of all significant risks within Cybersecurity, Technology, Enterprise Data, and Resiliency/Continuity Planning areas of the Bank.
• Build and maintain processes necessary to independently monitor Technology division and Business Unit adherence to corporate risk policies, defined Business unit procedures and key risk related controls. Make enhancements to the processes when necessary to ensure independent oversight satisfactory.
• Review and validate technology and cybersecurity risk/event data, testing or monitoring results collected and analyzed by team members for inclusion in monthly risk reporting to senior management.
• Establish and lead a data analytics, metrics, and reporting function that supports the needs of technology and cybersecurity risk oversight activities and requirements.
• Execute and validate fulfillment of ad hoc data requests related to operational risks and events.  Analyze technology and cybersecurity risk and event information to assist in identifying trends to mitigate future losses.
• Effectively communicate with others throughout the Bank, including senior management, via phone, email or in person to obtain information necessary for the completion of reporting, project information and issue resolution.
• Prepare and deliver materials/presentations to senior managers.
• Participate in various risk committees, understand and utilize the Enterprise Risk Framework, implement the practices, processes and tools necessary to effectively perform oversight duties and ensure the Bank's remains within its risk appetite.
• Serve as primary point of contact to assist others in communicating with the Technology division and Business Units by aiding providing clear message and what is required.
• Indirect participation in specific regulatory inquiries, examinations and ongoing periodic status updates.  Serve a departmental represented in discussions with