Information Technology Enterprise Risk Manager

• Support execution and oversight of Northwest's Operational Risk framework for information technology, information security, and data risks
• Oversee technology-related Risk and Control Self-Assessments (RCSA), challenge conclusions, and monitor routines
• Independently assess risks and drive actions addressing root causes of significant residual operational risk
• Validate first-line control testing and independently test IT, information security, and data controls
• Mature second-line technology and information security risk assessments, document controls, identify gaps, and create action plans
• Support key risk assessments, including GLBA, authentication and access, PCI DSS, and HIPAA assessments
• Consult on issues addressing control gaps and monitor remediation progress
• Establish and review metrics measuring technology risks and challenge deficient-metric action plans
• Oversee front-line IT, information security, and data activities and exception handling
• Challenge IT, information security, and data policies and standards for corporate governance compliance
• Analyze losses associated with IT failures, disruptions, and errors; identify root causes and recommend future risk avoidance
• Ensure compliance with company policies, procedures, and federal/state regulations
• Navigate Microsoft Office and department-specific applications
• Work as part of a team and with on-site equipment
• Perform additional duties assigned by management

• Bachelor's Degree in Management Information Systems, Cybersecurity, or Business Administration
• 8–12 years of cybersecurity/information technology experience
• 6–8 years of prior financial institution experience
• Deep understanding of information technology, information security, and data principles and best practices
• Proficiency in risk management methodologies, frameworks, and RCSA execution
• Knowledge of NIST CSF, GLBA, PCI DSS, and HIPAA
• Experience with vulnerability scanning and penetration testing tools
• Strong analytical and problem-solving skills
• Excellent communication and reporting abilities
• Ability to comply with Northwest policies and procedures and federal/state regulations
• Ability to navigate Microsoft Office, computer applications, and department-specific software
• ITIL, CISA, CISM, CRISC, and CISSP certifications are listed

Demonstrates expertise in managing operational risk frameworks, particularly in information technology and information security, while ensuring compliance with relevant regulations. Proficient in risk management methodologies and capable of conducting thorough risk assessments and control testing.

• ITIL
• CISA
• CISM
• CRISC
• CISSP