Tech Risk and Controls Lead-Vulnerability Management, Network security controls

Join a role that's central to our technological controls and standards, offering a unique opportunity to shape the firm's tech controls strategy in alignment with various standards and regulatory requirements.

As a Tech Risk and Controls Lead at JPMorgan

Chase within Cybersecurity Technology and Controls, you will lead the enterprise governance and orchestration of the Vulnerability Management function. Serving as the central governance lead and connective layer across Vulnerability Management Product, Engineering, Operations, Risk Intelligence, Standards and Control Design, control owners, and line-of-business teams, you will establish clear decision rights, integrate end-to-end oversight, and drive consistent outcomes without displacing technical execution or remediation accountability.

The role combines cybersecurity risk and controls expertise with enterprise leadership to strengthen discovery and coverage efficacy, material‑change governance, systemic issue management, metrics, regulatory readiness, and continuous improvement across cloud, data center, endpoint, application, container, and other technology environments.

• Lead the enterprise Vulnerability Management governance function, providing a central coordination point for cross-functional accountability, governance challenge, and escalation
• Establish and maintain the Vulnerability Management governance charter, operating model, decision rights, forums, RACI, materiality thresholds, and escalation pathways
• Orchestrate collaboration across Vulnerability Management Product, Engineering, Operations, Risk Intelligence, Standards and Control Design, control owners, Product Security, and line-of-business teams while preserving clear technical and remediation ownership
• Chair or coordinate enterprise Vulnerability Management governance forums, ensuring working groups prepare complete evidence and decision‑making bodies record accountable, timely, and traceable outcomes
• Govern material changes to discovery, coverage, feeds, integrations, scoring, filtering, bundling, exemptions, and inclusion or exclusion rules through documented impact assessment, testing, approval, communication, and post‑implementation validation
• Drive systemic root‑cause and thematic analysis of vulnerabilities, control failures, recurring defects, data‑quality issues, and finding concentrations; translate insights into enterprise corrective actions with clear ownership and tracked closure
• Define and oversee enterprise metrics and reporting that measure discovery and coverage efficacy, control outcomes, governance health, service performance, rule compliance, remediation trends, and downstream impact
• Coordinate enterprise responses to systemic issues and ensure local remediation, exception, and risk‑acceptance decisions remain with the appropriate control and business owners
• Partner with the Vulnerability Management Product or Service Owner on strategy, roadmap, prioritization, capability uplift, annual coverage review, and the distinction between routine improvement and material enterprise change
• Coordinate with Audit, Compliance, Operational Risk, and regulatory engagement teams to ensure Vulnerability Management leaders can provide coherent, evidence‑based explanations of firmwide scope, methodology, control outcomes, and material decisions
• Promote automation, reusable governance patterns, and auditable workflows that improve the quality, timeliness, and traceability of Vulnerability Management decisions and follow‑through

• Formal training or certification on tech risk and controls concepts and 10+ years applied experience in cybersecurity, technology risk, Vulnerability Management, security engineering,…