ORM Technology & Cyber Risk Manager
Overview:
The Operational Risk Management (ORM) Group at Citi is the firms reliable second set of eyes. Our mission is to drive comprehensive and consistent practices designed to identify, measure, monitor, report and manage operational risks. The ORM Technology and Cyber Office (TCRO) team provides the specialist subject matter experts to challenge Enterprise, Infrastructure, Operations and Technology entities across the firm. We are the technology and cyber risk conscious of the bank. In line with the ORM framework, we aim to ensure that the internal controls that are designed to mitigate technology and cyber risks are managed, mitigated, and aligned with Citi's risk appetite.
Responsibilities:
Reporting into the Director of Technology/Cyber Risk within TCRO, the Technology and Cyber - SVP will have risk oversight over Global Functions Technology and Citi Shared Services. The following highlight the coverage area high-level responsibilities for this position:
- Provide independent risk oversight in support of Cit's risk appetite on the processes by which Citi's Technology Operational Entities provide technology services and products.
- Guide, influence, and advice on the coverage area risk management activities by leveraging subject matter knowledge to drive Citi's mission and value proposition.
- Partner with first, second, and third lines of defense to identify, measure, monitor, report and manage IT risks that could affect Citi's risk profile.
- Monitor and assess potential internal and external threats and vulnerabilities to identify emerging risks.
- Serve as subject matter expert and deliver value-added IT risk and controls guidance across businesses.
- Provide effective challenge of technology/cyber risks and controls via various work efforts (e.g., risk assessments, lessons learned, etc.).
Specific responsibilities include:
- Identify and track technology/cyber risks including related indicators and influence the prioritization.
- Independently assess inherent and residual technology and cyber risks.
- Advise on continuous monitoring and control test methods and recommend technology metrics in support of decisions concerning technology control objectives.
- Participate in various initiatives and provide guidance related to risk reduction efforts (e.g., control enhancements, remediation closures, etc.).
- Influence/challenge business and technology risk self-assessments.
- Influence/challenge technology scenario analysis activities.
- Influence/challenge lessons learned reviews performed by the business and technology.
- Lead independent operational risk reviews.
- Identify gaps, inconsistencies and other integrity issues in technology controls and risk metrics and recommend solutions.
- Verify and validate technology/cyber control measures.
- Oversee the management of technology control issues.
- Advice on best practices leveraging expertise and industry insights.
Qualifications:
The Technology and Cyber - SVP will have over 12+ years of hands-on technical experience in Information/Cloud Security, Risk and controls within globally complex, dispersed and diverse organizations. He/she will have sound understanding of risk assessment methodologies, internal controls, and industry technology risk management frameworks and best practices (e.g., COBIT 2019, NIST CSF, CRI, RFM, ISO 27001) and will proactively remain abreast of emerging technology and cyber risks. He/she will set and drive high standards; perspective that fosters risk identification and mitigation techniques, and a commitment to transparency and learning that helps builds a strong risk culture. The expected result is to help protect the firm and its reputation while enabling progress.
More specific proven experience, knowledge and skills are outlined below:
- Experience with security protections and techniques in one or more of the following areas: applications, database, cloud, network infrastructure, and/or data.
- Experience with enterprise technology architecture as a holistic structure that includes people, process, and technology components combined to achieve business goals for automation.
- Experience leading operational risk reviews including identification of potential issues, and coordination with various teams including leadership.
- Strong knowledge and/or experience in risk assessment and measurement of cloud applications, infrastructure components, and database management systems.
- Strong knowledge and/or experience in system, software, and security/software development lifecycle including their risk identification, and assessments.
- Working familiarity with data warehousing and big data environments.
- Working familiarity with automated monitoring tools and incident tracking tools to effectively communicate and manage incidents, defects, and data quality issues.
- Plus if candidate has previous experience with corporate functions or similar applications (e.g. Systems supporting Human Resources, Legal, Risk, Compliance, Corporate Treasury, etc.).
- Plus if candidate has previous experience with emerging technologies.
Competencies:
- Ability to interact with and influence people/groups of widely varying disciplines and backgrounds.
- Ability and confidence to exercise influence over a wide range of individuals at all levels of technical & business leadership.
- Strong presentation skills: able to use data to tell a clear and compelling story.
- Strong analytical and problem-solving skills.
- Comfortable with public speaking across various forums and be able to effectively and logically communicate when ideas are being challenged in an open forum.
- Comfortable interacting directly with technology executive leadership, including in a high stress environment.
- Understands the perspective of regulators and has the ability to shape messages and content to respond to the requirements.
- Strong planning, organization and time management experience that is strategically oriented, an innovative thinker, and a demonstrated and decisive decision maker.
- Able to collaboratively manage initiatives that span multiple geographic locations and time zones.
- Navigates organizational complexity; demonstrates organizational savvy.
- Builds partnerships across functions and regions; collaborates well with others.
Logistics:
- The role is global, and the incumbent must be proactive and capable of leading solutions to global issues with others in different regions and time zones.
- The successful candidate will need to be a hands-on, self-starter, and able to manage tasks/timelines for self and others.
Education:
- Bachelor’s/University degree, Master’s degree a plus.
- Related industry certifications (e.g., CISSP, CCSP, CISM, CCSK, CIPP).
-------------------------------------------------
Job Family Group:
Risk Management-------------------------------------------------
Job Family:
Operational Risk------------------------------------------------------
Time Type:
Full time------------------------------------------------------
Primary Location:
Tampa Florida United States------------------------------------------------------
Primary Location Salary Range:
$136,700.00 - $205,050.00------------------------------------------------------
Citi is an equal opportunity and affirmative action employer.
Qualified applicants will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.
Citigroup Inc. and its subsidiaries ("Citi”) invite all qualified interested applicants to apply for career opportunities. If you are a person with a disability and need a reasonable accommodation to use our search tools and/or apply for a career opportunity review Accessibility at Citi.
View the "EEO is the Law" poster. View the EEO is the Law Supplement.
View the EEO Policy Statement.
View the Pay Transparency Posting