Senior Technology Risk Analyst

Job Description:

Position Description
:

Provides risk and controls consulting on Dev Ops, Cloud migration, and new technologies. Coordinates Enterprise external audit technology engagements including Service Organization Controls (SOC) 1 and attestation reports in close partnership with the business unit technology risk teams. Works with technology teams, business owners, Enterprise Cybersecurity (ECS), Enterprise Infrastructure (EI), Cloud and Platform Engineering (CAPE), BU Technology partners, BU Operations Risk, and external auditors.

Leverages analytical tools to gather data, analyze the information and uncover key insights that can be presented through data visualizations planning and coordination of audit cycles with external auditors and internal stakeholders. Applies the concepts of application development, deployment, and management patterns, and Dev Ops and Continuous Integration and Continuous Delivery (CI/CD) practices in the risk assessment. Performs risk assessments, control assessments, and IT Audits, or implements Cybersecurity controls in mainframe, distributed, network and Cloud environments.

Presents the risk findings using business intelligence and visualization tools including Excel, Alteryx, Tableau, or Power BI.

Primary Responsibilities:

• Develops and monitors controls related to Dev Ops, Cloud, and new technologies to meet audit objectives and requirements.

• Identifies, tracks, monitors, reports, and advises any risks to external audit engagements.

• Helps enhance and run external audit oversight program activities, including defining and executing the external audit strategy and program.

• Develops best in class standards and practices for external audits.

• Works closely with the various business unit technology risk and Enterprise Technology Risk (ETRA) Center of Excellence (COE) to perform proactive risk and control assessments for externally audited environments, monitors technology controls, and documents remediation plans.

• Conducts in depth information technology risk assessments including documenting controls, identifying potential gaps and/or inconsistencies, and making sound recommendations for improvement and/or mitigation.

• Develops analytics to proactively identify risk across the firm mainly in high impact areas including logical access, application resiliency, cloud, and vendor.

Education and Experience
:

Bachelor’s degree in Computer Science, Engineering, Information Technology, Information Systems, Management Information Systems, Business Administration, or a closely related field (or foreign education equivalent) and three (3) years of experience as a Senior Technology Risk Analyst (or closely related occupation) performing Information Technology (IT) audits, risk assessments, and cybersecurity control review.

Or, alternatively, Master’s degree in Computer Science, Engineering, Information Technology, Information Systems, Management Information Systems, Business Administration, or a closely related field (or foreign education equivalent) and one (1) year of experience as a Senior Technology Risk Analyst (or closely related occupation) performing Information Technology (IT) audits, risk assessments, and cybersecurity control review.

Skills and Knowledge
:

Candidate must also possess:

• Demonstrated Expertise (“DE”) performing and coordinating external audit engagements for a large distributed enterprise -- SOC 1, 2, and 3, controls attestation reports, financial audits, and ISO 27001 external IT audit programs; coordinating responses to auditor requests for information with internal IT organizations; maintaining in-scope IT General Control (ITGCs) and IT Application (ITAC) documentation and procedures; and providing recurring management status reporting.

• DE executing IT controls assurance programs by identifying and designing new controls, evaluating control procedures and evidence documentation, and conducting control assessments through formal design and operating effectiveness reviews; establishing control maturity and control/process enhancements using industry control frameworks -- American Institute of Certified Public Accountants (AICPA) Trust Service Criteria, ISO 27002…