AVP, Operational Risk – Information Technology Oversight

Role Summary/Purpose

The Operational Risk Management team is part of the 2nd Line of Defense (2

LOD) within Synchrony. This role is responsible for performing independent operational risk oversight of information technology within Synchrony. This includes assessing and monitoring risks related to IT programs, adoption of emerging technologies and 3rd party risks specific to the IT function. The position reports to the VP, Information Technology Oversight.

• Engage the Information Technology organization in reviewing and assessing operational risks in the selection, deployment and use of new technologies being introduced into the Synchrony Technology Stack. This includes the re-use of existing technology being leveraged in new ways to solve business problems
• Monitor risks being accepted by the business and provide an independent assessment of the risk-taking activities
• Perform formal assessments of technology risks using common processes within Risk Management, including Targeted Reviews, Concurrent Reviews and Continuous Monitoring
• Independently investigate potential risks being taken by Information Technology teams and elevate through ORM processes
• Monitor Cloud Computing and Public Cloud Service activities related to AWS, Azure to develop control objectives based on regulatory guidance and assess the risks in Synchrony’s deployment of these technologies
• Contribute to and validate delivery on Alpha, Beta and General Availability requirements for Cloud and new technology certifications across IT teams (Applications and Infrastructure). Confirm evidence provided for each certification and ongoing sustainability of requirements for each phase.
• Attend and represent 2
  
  LOD at various forums, including but not limited to:
  Cloud Design Authority (CDA), Architecture Review Board (ARB), Enterprise Architecture Forum, and Program Increments (PI) sessions for various sprint teams (Cloud, Security, etc.),
• Review risks within IT third-party supplier base with consideration for unique risks based on the vendor relationship and services (e.g., purchased software, software as a service, service providers, staff augmentation, etc.)
• Manage risks and issues within the Synchrony’s enterprise governance application (eGRC)
• Perform other duties and/or special projects as assigned
• Support 2nd Line of Defense processes such as the Enterprise Risk Assessment (ERA) and Risk and Control Self-Assessment (RCSA) processes

• Engage the Information Technology organization in reviewing and assessing operational risks in the selection, deployment and use of new technologies being introduced into the Synchrony Technology Stack. This includes the re-use of existing technology being leveraged in new ways to solve business problems
• Monitor risks being accepted by the business and provide an independent assessment of the risk-taking activities
• Perform formal assessments of technology risks using common processes within Risk Management, including Targeted Reviews, Concurrent Reviews and Continuous Monitoring
• Independently investigate potential risks being taken by Information Technology teams and elevate through ORM processes
• Monitor Cloud Computing and Public Cloud Service activities related to AWS, Azure to develop control objectives based on regulatory guidance and assess the risks in Synchrony’s deployment of these technologies
• Contribute to and validate delivery on Alpha, Beta and General Availability requirements for Cloud and new technology certifications across IT teams (Applications and Infrastructure). Confirm evidence provided for each certification and ongoing sustainability of requirements for each phase.
• Attend and represent 2
  
  LOD at various forums, including but not limited to:
  Cloud Design Authority (CDA), Architecture Review Board (ARB), Enterprise Architecture Forum, and Program Increments (PI) sessions for various sprint teams (Cloud, Security, etc.),
• Review risks within IT third-party supplier base with consideration for unique risks based on the vendor relationship and services (e.g., purchased software, software as a service, service providers, staff augmentation, etc.)
• Manage risks and issues within the…