Information Technology Risk LoD Lead

We are seeking a highly skilled, experienced, and strategic Director of Technology Risk (LoD1) and Software Asset Management (SAM) Lead to play a critical role in safeguarding the Natixis CIB Americas IT landscape and ensuring compliance with complex industry regulations.

In this executive-level role, you will serve as the primary interface for the Line of Defense 1.1 Group (comprising the Groupe BPCE and Natixis CIB Head Office in Paris) and Line of Defense 2 (including the CISO, Operational Risk, and Compliance teams) regarding IT risk taxonomies, framework alignment, and risk remediation. You will be vital to ensuring the robust security and compliance of Natixis CIB Americas IT, managing high-value software assets effectively, and mitigating risks associated with information technology operations.

The successful candidate will possess a deep understanding of IT risk frameworks, software licensing agreements, and industry best practices. You will lead the implementation of the Group IT Risk Management (ITRM) Framework, tailoring it to meet specific business and regional needs, while driving initiatives to assess, monitor, and enhance IT controls across the Americas platform.

Drive IT Risk Strategy: Strengthen and execute the IT risk management strategy in strict alignment with Head Office (Groupe BPCE and Natixis CIB), organizational goals, and evolving regulatory expectations.

Lead Software Asset Management: Oversee the Americas SAM program, including process optimization, governance frameworks, and strategic contribution to the associated corporate policies managed at LoD
2.

Conduct Comprehensive Assessments: Participate in, and periodically lead, risk assessments, vulnerability assessments, and audits to identify potential IT risks, propose robust mitigation plans, and recommend appropriate controls.

Prioritize Systemic Risks: Oversee and assist in the identification, analysis, and prioritization of risks associated with critical IT systems, proprietary software applications, and third-party vendors.

Establish Runbooks and Procedures: Develop, document, and maintain rigorous IT risk management procedures and associated operational runbooks in accordance with industry regulations and global bank standards.

Enforce SAM Lifecycle Management: Oversee the complete lifecycle of software assets from acquisition to retirement, ensuring compliance with complex licensing agreements, mitigating financial exposure, and optimizing usage in alignment with Head Office processes.

Perform System Integrity Checks: Conduct daily health and completeness checks for all software assets within the IT Asset Management (ITAM) platform.

Manage System Enhancements: Drive feature enhancements for the ITAM tool, collaborating closely with IT teams to prioritize, test, and implement functional improvements, particularly within the SAM space.

Facilitate Asset Recertification: Coordinate the ITAM Annual Recertification process in partnership with IT asset owners to ensure the ongoing integrity, compliance, and accuracy of software inventories.

Partner with Key Stakeholders: Liaise with business, risk, and IT stakeholders to facilitate IT controls reviews, ensuring all regulatory and internal controls are met, documented, and reported.

Deliver Senior-Level Reporting: Prepare and present risk and control reports, including Data Risk Strategy (DRS) and operational risk reports, for executive and senior management.

Manage Risk Acceptances: Evaluate, document, and submit risk acceptances for the Chief Information Officer (CIO) Office, ensuring detailed justification for any temporary exceptions.

Enhance Operational Security: Coordinate the implementation and knowledge-transfer processes for Multi-Factor Authentication (MFA) across relevant applications to continuously strengthen the perimeter.

Remediate EOL Exposures: Perform random sampling and quality assurance on the End-of-Life (EOL) remediation tracking systems to ensure effective hazard mitigation.

Foster an Accountability Culture: Develop and deliver targeted training programs to educate teams on IT risk management, regulatory expectations, and software licensing compliance, fostering a pervasive culture of risk awareness.

Monitor Emerging Trends: Stay at the forefront of industry trends, emerging technologies,…