Manager, Technology Risk & Controls

Role Overview

The Manager, Technology Risk & Controls leads the Technology Risk and Cybersecurity Assurance function within Internal Controls orting to the Senior Manager, Internal Controls, this role is accountable for establishing and operating the technology risk and cybersecurity assurance framework across the organization. Operating in a dynamic environment, the Manager leads a team of Senior Analysts and is responsible for navigating ambiguity, building structure, and driving outcomes.

The role partners with Technology, Operations, and business leadership to embed a strong control environment and enable risk‑informed decision‑making. As a trusted advisor, the Manager is accountable for identifying, assessing, and mitigating technology risks across systems, infrastructure, OT, and third‑party services, including oversight of IT General Controls (ITGCs) supporting financial and operational reporting.

• Lead the development, implementation, and continuous enhancement of the Operational Technology Cybersecurity Framework, including maturity assessments across assets, systems, and applications
• Oversee technology risk identification, assessment, and mitigation
• Ensure appropriate cybersecurity controls and ITGCs are designed and operating effectively across internal teams and managed service providers
• Drive timely remediation of risks, audit findings, and control deficiencies

• Own and maintain the Technology Risk Register aligned with enterprise risk standards
• Define and monitor KRIs to assess risk exposure and control effectiveness
• Perform thematic analysis to identify emerging risks, trends, and systemic control gaps across the technology landscape
• Deliver executive‑level technology risk reporting and insights to senior leadership and Operational Risk
• Support Business Impact Analysis (BIA) and Business Continuity Planning (BCP) activities

• Develop and continuously improve technology risk policies, standards, and procedures
• Ensure alignment with enterprise frameworks and leading practices (NIST, ISO, COBIT, CIS)
• Embed risk management into technology operations, projects, and delivery processes

• Serve as a trusted advisor to Technology, Operations, and business leaders, providing risk‑based guidance and fostering a strong risk‑aware culture
• Lead internal and external technology risk, cybersecurity, and ITGC audits, including stakeholder coordination, assurance requests, response management, and deliverable quality review
• Drive accountability for the timely remediation of audit findings, control deficiencies, and key technology risks
• Represent Service Assurance in governance forums, steering committees, and cross‑functional initiatives, influencing risk‑informed decision‑making aligned with business objectives
• Conduct targeted reviews of systems, processes, and controls to assess risk exposure, control effectiveness, and improvement opportunities

• Lead cybersecurity and technology risk awareness initiatives, developing guidance and training to strengthen risk management and control practices
• Monitor regulatory developments and industry trends, ensuring frameworks, processes, and tools remain aligned with leading practices
• Drive continuous improvement by enhancing risk management capabilities, promoting proactive risk identification, and fostering a strong risk‑aware culture

• Lead, mentor, and develop a high‑performing team, fostering a collaborative, accountable culture while building capability in technology risk, cybersecurity, and assurance
• Set clear expectations, manage priorities, and provide direction in complex or ambiguous situations to ensure the timely delivery of high‑quality outcomes

• Degree in Business, Technology, Risk Management, Cybersecurity, or a related field, with 5–7 years of experience in technology risk, cybersecurity, internal controls, audit, or regulatory compliance
• Strong knowledge of technology risk management, cybersecurity principles, IT…