IT Risk Lead

Purpose

The IT Risk Lead is responsible for measuring, monitoring, and evaluating the risk and control environment ensuring technology solutions are in alignment with the Bank’s risk appetite.

This role will have a comprehensive understanding of the Bank’s technology operating environment to proactively identify risks, controls, issues, and changes in the risk profile of the underlying systems.

• Lead assessments based on the IT risk management framework and applicable industry best practices.
• Lead identification of technology control or process deficiencies based on established IT and Information Security standards.
• Lead IT and Information Security Risk and Control Self‑Assessments to identify, assess and evaluate technology operational risk.
• Engage IT and Information Security stakeholders to support risk mitigation and effectiveness of technology controls.
• Review action plans to ensure appropriate mitigation and alignment with risk appetite.
• Review evidence for remediation plans to ensure appropriate risk mitigation.
• Monitor risk indicators and enterprise IT and Information Security metrics to assess overall technology risk profile.
• Review risk events to assess breakdown in controls, processes, and mitigation strategies.
• Assist in conducting Artificial Intelligence (AI) risk assessments in alignment with the NIST AI Risk Management Framework.
• Research IT and Information Security emerging risk trends to implement best practices to support the program.
• Coordinate implementation of process improvement changes to optimize the program.
• Monitor action plans to ensure completion of mitigation strategies within established target due date timelines.
• Collaborate with other enterprise risk management functions to support risk mitigation.
• Participate in various enterprise working groups to support continuous risk engagement.
• Assist in the preparation of IT and Information Security risk reports for the Risk Committee, and Risk Oversight Committee of the Board of Directors.
• Other risk management duties as assigned.

• Business Systems/Technology Complexity
• Banking Industry Knowledge
• General Decision Making/Judgment
• Dependability
• People Relationship Development
• Interpersonal Skills

• Bachelor’s degree with a minimum six (6) years’ relevant IT risk, information security, compliance, or IT audit experience in a financial services environment.
• Master’s degree in technology, finance, or business is preferred.
• Certifications such as CISSP, CCSP, CISM, and/or CRISC are an added advantage.
• Experience with risk assessment, interpretation, analytical and collaboration skills.
• Big 4 or technology consulting experience is an added advantage.
• Experience with Azure cloud security, risk, and compliance, including knowledge of security design constructs, principles, and blueprints for application architectures.
• Active industry certifications related to cloud security, i.e., Azure Fundamentals, Azure Security Technologies etc., are an added advantage.
• Proficient verbal and written communication skills, including the ability to effectively lead discussions and meetings.
• Ability to handle a variety of projects simultaneously.
• Technical skills experience required: control assessment, IT risk management, monitoring metrics and reporting, technical problem resolution, and project management.
• Working knowledge within the following IT risk domains or technologies is an added advantage:
  Database, Application, Network Security, and Cloud Security, Identity and Access Management, Change Management, Threat, and Vulnerability Management.
• Must not have been convicted on any civil or criminal charge that would suggest a risk to Bank security.
• Ability to work full-time.
• Ability to uphold and model the Bank’s Guiding Principles.

Hiring Range: $113,000 - $133,000. Hiring ranges reflect the base salary that the Bank reasonably expects to pay for a given role and are not inclusive of annual incentive award opportunities, retirement benefits or the value of other health and welfare or other ancillary benefits.

• Flexible hybrid workforce model:
  Onsite three days a week and two days remote, with remote flex…