Tech Risk and Controls Lead - Central Infrastructure Platforms

Job responsibilities

• Ensure effective identification, quantification, communication, and management of technology risk, focusing on root cause analysis and resolution recommendations.
• Independently validate issue remediation and closure readiness, testing action plan evidence to confirm root causes are resolved and fixes will last.
• Perform quality reviews of issue lifecycle documents (issue creation, extensions, and action plan closures) to confirm root causes are clear, severity is accurate, and narratives are complete.
• Proactively monitor and evaluate control design and operating effectiveness, identify gaps, and recommend enhancements to strengthen risk posture and regulatory compliance.
• Support risk reduction assessments and escalations by assessing residual risk and recommending compensating controls or extended remediation where gaps remain.
• Uses enterprise-authorized AI capabilities within the work environment to accelerate synthesis of risk/control evidence and draft executive-ready reporting, validating outputs and handling data according to sensitivity and security requirements.
• Develop and maintain strong relationships, becoming a trusted partner to LOB technologists, governance teams, and TRC partners to support cross-functional collaboration and progress toward shared goals.
• Execute reporting and governance of controls, policies, issue management, and measurements, giving senior management insight into control effectiveness, validation outcomes, and recurring remediation trends.
• Promotes reuse-first, AI-assisted approaches to streamline recurring control testing and issue/action-plan management routines, ensuring human review and alignment to auditability and regulatory expectations.
• Help improve overall TRC standards, testing procedures, and playbooks over time.

Required qualifications, capabilities, and skills 

• 5+ years of experience or equivalent expertise in technology risk management, Internal Audit, or a related governance field, with a focus on risk evaluation, control testing, and issue management.
• Demonstrated experience using enterprise-authorized AI capabilities within the work environment to support technology risk and controls workflows with strong validation habits and awareness of data sensitivity.
• Ability to review and validate AI-assisted risk summaries and recommendations before use, escalating when uncertain and ensuring outcomes align to security, auditability, and regulatory expectations.
• Hands-on experience testing control design and operating effectiveness, including evidence evaluation and workpaper documentation.
• Strong root cause analysis skills, with the ability to tell whether remediation fixes the systemic problem or only the symptom.
• Working knowledge of the full issue lifecycle (issue creation, action plans, extensions, and closure) in a regulated financial institution.
• Familiarity with risk management frameworks, industry standards, and financial industry regulatory requirements.
• Proficient knowledge and expertise in risk assessment and reporting, control evaluation, design, and governance, with a proven record of implementing effective risk mitigation strategies.
• Ability to influence senior stakeholders by turning risk insights and conclusions into clear, actionable recommendations.
• Sound professional skepticism and strong written communication, with the ability to write concise, defensible conclusions for executive audiences.

Preferred qualifications, capabilities, and skills 

• CISA, CISM, CRISC, CISSP, or similar industry-recognized risk/audit certifications.
• Prior Internal Audit, regulatory examination, or external audit experience, especially in issue validation, closure testing, or control assessments.
• Experience writing test procedures, acceptance criteria, or QA/QC review standards.
• Data analysis skills to support data-driven testing and reporting.