Business Controls Senior Associate - Privacy GLBA​/PCI

Make banking a Fifth Third better We connect great people to great opportunities. Are you ready to take the next step? Discover a career in banking at Fifth Third Bank.

GENERAL FUNCTION As a first line of defense, provides specialized Business Controls support focused on identifying, assessing, mitigating, monitoring, and managing privacy, information protection, and regulatory risks, with particular emphasis on the Gramm-Leach-Bliley Act (GLBA) and Payment Card Industry Data Security Standard (PCI DSS). Responsible for coordinating and conducting GLBA Risk Assessments, supporting PCI Report on Compliance (ROC) efforts across applicable lines of business, and planning and executing internal PCI assessments.

Partners with lines of business to evaluate privacy and data protection risks, assess the design and effectiveness of controls, identify gaps, and support the development and implementation of appropriate remediation. Serves as a subject matter expert for GLBA, PCI, and related privacy risk and control requirements, providing guidance to business partners and working closely with Legal, Compliance, Enterprise Risk, Information Security, Technology, Audit, and other key stakeholders.

Monitors changes in applicable laws, regulations, standards, and regulatory guidance and assists the business in understanding and incorporating those requirements into business processes and controls. Supports Business Controls in advancing privacy risk management practices, processes, assessments, reporting, and tools within the organization’s Enterprise Risk Management (ERM) framework. Develops and presents meaningful risk information and insights to stakeholders to support informed decision-making and effective management of privacy and data protection risks.

Responsible and accountable for risk by openly exchanging ideas and opinions, elevating privacy, security, and control concerns, and following established policies and procedures. Operates within the Bank’s and lines of business’ established risk appetites while consistently identifying, assessing, managing, monitoring, and reporting privacy, data protection, and related operational risks.

• Leads and coordinates GLBA Risk Assessments for applicable lines of business, including identification and evaluation of privacy and information protection risks, controls, potential gaps, and remediation needs.
• Supports the organization’s PCI Report on Compliance (ROC) activities across applicable lines of business, including coordination of assessment activities, evidence collection, control validation, documentation, and engagement with business stakeholders and the external Qualified Security Assessor (QSA).
• Plans, coordinates, and executes internal PCI assessments to evaluate compliance with applicable PCI DSS requirements and the effectiveness of associated business processes and controls.
• Serves as a Business Controls subject matter expert for GLBA, PCI, and related privacy and data protection requirements, providing guidance and interpretation to lines of business and other stakeholders.
• Partners with business leadership to develop and implement controls, policies, procedures, and sustainable processes designed to effectively manage privacy, GLBA, PCI, and data protection risks.
• Provides expertise and analysis related to the identification, assessment, control, monitoring, testing, and reporting of privacy and information protection risks.
• Evaluates business processes involving the collection, use, storage, transmission, sharing, retention, and protection of sensitive information to identify potential privacy, GLBA, and PCI-related risks and control gaps.
• Maintains awareness…