Enterprise Incident Management - Scenario Library Lead

The position is described below. If you want to apply, click the Apply Now button at the top or bottom of this page. After you click Apply Now and complete your application, you'll be invited to create a profile, which will let you see your application status and any communications. If you already have a profile with us, you can log in to check status.

Need Help?

If you have a disability and need assistance with the application, you can request a reasonable accommodation. Send an email to Accessibility (accommodation requests only; other inquiries won't receive a response).Regular or Temporary:

Regular Language Fluency:  English (Required)

Work Shift:

1st shift (United States of America)
Please review the following job description:

The Scenario Library Lead owns Truist's all-hazards library of severe but plausible scenarios, the basis on which the bank determines whether each important business service can remain within its impact tolerance under severe disruption. Each scenario must be severe enough to identify the point of failure and credible enough for service owners, executives and examiners to accept.

Frontier AI is the role's primary focus. The same models that speed up legitimate work are available to adversaries, run inside the bank's own processes and sit inside the services its third and fourth parties deliver, and the role writes the scenarios in which they cause or amplify a disruption.

The role requires a working understanding of how these systems are built, how they fail and how adversaries use them, applied to scenarios the bank can test against. It is an operational resilience position within Enterprise Incident Management.

Scenario library ownership
• Build and maintain the enterprise library of severe but plausible scenarios, including its taxonomy, a coverage map against important business services and their impact tolerances, version control and an annual refresh cycle.
• Write every scenario to a single standard: trigger, cascade, timeline, affected services and dependencies, assumptions, severity rated against the Board-approved Enterprise Incident Severity Matrix, and the questions the test must answer.
• Establish and defend the plausibility threshold with evidence drawn from threat intelligence, Truist incident history and after-action reviews, industry events and supervisory expectations.
• Maintain all-hazards coverage across the library's six categories (cyber; third party and concentration; infrastructure and facility; natural and climate; people and insider; liquidity and confidence), including compound scenarios in which two events strike together, with frontier AI-enabled scenarios as the primary area of new development.
• Retire scenarios that no longer meet the threshold and document the rationale.

Frontier AI-enabled scenarios
• Develop the scenarios in which an adversary applies frontier models against the bank, including AI-generated exploits against Truist's technology estate, autonomous intrusion agents, voice and video cloning directed at Truist and its clients, synthetic identity fraud at scale, and AI-driven disinformation that produces deposit outflows.
• Develop the scenarios in which the bank's own AI systems fail, including agents acting beyond their mandate, poisoned training or retrieval data, prompt injection against teammate- and client-facing assistants, undetected drift in models used for decisions, and loss of a model provider or hosted API on which the bank depends.
• Develop the scenarios in which a 3rd, 4th, or nth party's AI fails or is compromised, including a core processor's or payments vendor's model that blocks or misroutes legitimate transactions at scale, a vendor's AI-driven operations tooling that pushes a defective change to every…