Senior Technology Risk Analyst

Position Overview

The Senior Technology Risk Analyst reports to the Operational Risk Manager and supports enforcement of safe digital and technology practices for the Bank. Key responsibilities include IT, cyber, and data risk assessment, policy development, monitoring, reporting, and leading training and awareness initiatives.

With direction from the Operational Risk Manager, the Technology Risk Analyst operates with autonomy and fosters strong connections with risk and compliance teams, digital and technology teams, as well as other cybersecurity and business groups. This collaboration facilitates information exchange and helps in identifying, assessing, and deploying suitable solutions to achieve both cybersecurity and technology risk management goals.

• Conduct regulatory IT compliance and risk assessments to identify and address technology, data, compliance, and cybersecurity risks arising from both internal bank operations and third-party engagements. In tandem with these efforts, establish and sustain robust key risk indicators, monitoring mechanisms, assurance procedures, reporting frameworks, and additional controls, implementing select measures within the first line of defense and reinforcing them through targeted training and awareness initiatives.
• Deliver complex information and metrics clearly and confidently across verbal, written, and visual formats, adapting communication for varied audiences, including senior leadership and potentially the Board of Directors.
• Support and advise on the Bank’s technology products and services, focusing on new product risk management and coordinating closely with 2nd and 3rd line functions.
• Coordinate with internal and external stakeholders, such as IT, legal, compliance, audit, and business units, on information security and privacy matters and assist with audits and exam preparation and execution.
• Collaborate with the first line to assess and address privacy and cybersecurity risk and compliance concerns involving the Bank’s technology and digital operations, including third-party involvement. This entails analyzing and applying applicable laws, regulations, policies, and guidance to create or improve processes and programs, as well as to detect any deficiencies.

• Bachelor’s Degree preferred or equivalent education and related training
• Minimum of 5 years of experience with responsibilities in privacy, digital banking, compliance, risk management, and/or audit.
• Knowledge of privacy and cybersecurity compliance laws, rules, regulations, and risks such as GLBA, PCI-DSS, etc.
• Knowledge of information security and privacy frameworks, standards, and best practices, such as NIST, ISO, COBIT, GDPR, CCPA, etc.
• Demonstrated knowledge in area of focus
• Experience with conducting legal or regulatory research
• Experience drafting policies, procedures, job aids
• Experience providing risk management guidance
• Experience with interacting with audit, external accountant, and regulators
• Advanced analytical skills
• Ability to be a self-starter, flexible, and adaptive
• Strong interpersonal skills with the ability to work collaboratively and with people at all levels for the Bank. Possess a strong competence to remain objective while providing healthy, constructive, and productive challenge, be highly supportive of alternative viewpoints, remain strategic while defining risk management expectations, and demonstrate the ability to build consensus through influence, steadfastness, and partnership.
• Strong communication and presentation capabilities at the executive/board level

Work is performed in a normal office environment. Noise levels are usually moderate. This position involves travel to customers and property locations.

• Prolonged sitting
• Lifting from 5 to 10 lbs. (printer paper, storage boxes)
• Occasional bending or overhead lifting (storing files or boxes)
• The hazards are mainly those present in a normal office setting

This job description may not be all-inclusive. Employees are expected to perform other duties as assigned and directed by management. Job descriptions and duties may be modified when deemed appropriate by…