Lead SME _ First-Line Control Testing

Job Description

Must Have Technical/Functional Skills

Typically 12+ years of experience in operational risk, RCSA, internal controls, first-line control testing, compliance risk, internal audit, or related financial-services risk disciplines.

• Significant experience designing or transforming first-line control testing and RCSA programs within a bank or regulated financial institution.
• Deep knowledge of risk and control inventories, process taxonomy, risk assessment, key control identification, control design assessment, operating-effectiveness testing, sampling, evidence standards, issue management, QA, and reporting.
• Strong working knowledge of COSO 2013, the IIA Three Lines Model, 12 CFR 30 Appendix D, and relevant banking regulatory expectations.
• Experience across banking processes such as payments, consumer lending, mortgage, deposit products, checking account opening, loan origination, pricing, and marketing.
• Proven ability to develop regulator-ready methodologies, playbooks, templates, operating models, executive reports, and implementation roadmaps.
• Demonstrated experience leading workshops and managing senior stakeholders across first line, second line, Internal Audit, technology, data, and business operations.
• Strong technical review, analytical, problem-solving, communication, and executive-presentation skills.
• Experience coaching and assessing control testers through practical execution and quality-review cycles.
• Bachelor’s degree in finance, accounting, risk management, business, information systems, or a related discipline; advanced degree preferred.
• Relevant certification preferred, such as CPA, CIA, CISA, CRMA, CRCM, or equivalent risk/control qualification.

Lead the current-state assessment of the first-line control testing framework, process taxonomy, risk-rating criteria, key control standards, control design methodology, testing procedures, governance, QA, and reporting.

• Define and validate a defensible and reproducible methodology for identifying high-risk processes, documenting key risks, designating key controls, and determining control testability.
• Establish the maturity baseline and 12-month target state, ensuring recommendations are traceable to 12 CFR 30 Appendix D, COSO 2013, and the IIA Three Lines Model.
• Lead development of the process, risk, and control baseline for ten priority processes across multiple business areas.
• Oversee preparation and quality review of process inventories, process maps, KRCMs, control design assessments, testing plans, work papers, exception logs, and reporting templates.
• Direct operating-effectiveness pilot testing for ten key controls across three selected processes, including population definition, sampling rationale, evidence sufficiency, exception evaluation, conclusions, and reporting.
• Establish and enforce quality standards for tester qualification, documentation, evidence sufficiency, workpaper review, QA, issue escalation, and risk acceptance.
• Lead development of the target operating model, including roles, decision rights, governance forums, QA, escalation, issue linkage, KRIs, risk appetite linkage, and no-testing strategies.
• Facilitate workshops and working sessions with first-line business leaders, second-line risk, Internal Audit, control owners, data teams, technology stakeholders, and governance committees.
• Resolve complex methodology question s and provide clear recommendations while recognizing that final methodology, risk acceptance, control designation, remediation, and acceptance decisions remain with the Bank.
• Review and approve all technical deliverables before submission, ensuring findings are evidence-based and recommendations are prioritized by impact, effort, dependency, and ownership.
• Lead shadow and reverse-shadow activities, coach Bank testers, assess competency, and support achievement of the required first-pass quality threshold.
• Identify practical automation and Bank-approved AI opportunities, define reviewer controls and data-handling constraints, and ensure AI is not used to generate conclusions in pilot work papers.
• Support engagement governance through weekly working sessions, steering updates, risk and issue escalation, decision tracking, and Phase 1 gate-readiness assessments.
• Maintain compliance with Bank security, confidentiality, NPI-masking, data-handling, location, training, and third-party risk requirements.

• Executive stakeholder management
• Structured problem-solving
• Facilitation and…