The Technology Cyber Compliance & Operational Risk Office (TCCORO) Group at Citi is the firm’s reliable second set of eyes. Our mission is to drive comprehensive and consistent practices designed to identify, measure, monitor, report and manage operational risks. TCCORO provides the specialist subject matter experts to challenge Enterprise, Infrastructure, Operations and Technology entities across the firm. We are the technology and cyber risk conscious of the bank. In line with the ORM framework, we aim to ensure the internal controls that are designed to mitigate technology and cyber risks are managed, mitigated, and aligned with Citis risk appetite.

Responsibilities:

The Technology and Cyber Risk Officer - VP will have risk oversight over specific domains within Operations & Technology (O&T) including Global Functions Technology. The oversight includes influencing and challenging the processes by which Citis O&T Group provides technology services and products; independent assessments of the comprehensiveness and effectiveness of those processes, the inherent operational risks in technology process execution, the complete suite of control components in the information technology realm, and the acceptability of residual risk. The following highlights the coverage area responsibilities for this position: 

• Guide and influence the coverage area technology/cyber risk management activities by leveraging subject matter knowledge to drive organizations mission and value proposition.
• Provide independent oversight of Cits risk appetite using both a proactive and reactive approach. 
• Partner with first, second, and third lines of defense to identify, measure, monitor, report and manage IT risks that could affect Citis risk profile.
• Monitor and assess potential internal and external threats and vulnerabilities to identify emerging risks.
• Serve as subject matter expert and deliver value-added IT risk and controls guidance across businesses.
• Provide effective challenge of technology/cyber risks and controls via various work efforts (e.g., risk assessments, metrics, etc.)

Specific responsibilities include:

• Assess inherent and residual technology and cyber risks relevant to process execution, the suite of control components in the IT realm, and the acceptability of residual risk.
• Analyze data and leverage existing tools to identify risks and develop appropriate response.
• Assess the technology management processes and corresponding metrics data.
• Advise on continuous monitoring and control test methods and recommend metrics in support of decisions concerning technology control objectives.
• Lead and/or participate in various initiatives and provide guidance related to risk reduction efforts (e.g., control enhancements, remediation closures).
• Influence/challenge business and technology risk self-assessments.
• Influence/challenge technology scenario analysis activities.
• Influence/challenge lessons learned reviews performed by the business and technology.
• Lead and/or participate in independent operational risk reviews and capability assessments.
• Identify gaps, inconsistencies and other issues in technology controls and risk metrics and recommend solutions.
• Verify and validate technology/cyber control measures.
• Oversee the management of technology control issues.
• Advice on best practices leveraging expertise and industry insights.

Qualifications:

The Technology and Cyber Risk Officer - VP will have over 7 years of hands-on technical experience in Information Security, Risk and controls within globally complex, dispersed and diverse organizations. He/she will be well versed in information security governance and best practices (e.g., COBIT 2019, NIST CSF, CRI, RFM, ISO 27001) and will proactively remain abreast of emerging technology and cyber risks. He/she will set and drive high standards; perspective that fosters risk identification and mitigation techniques, and a commitment to transparency and learning that helps builds a strong risk culture. The expected result is to help protect the firm and its reputation while enabling progress.

More specific proven experience, knowledge and skills are outlined below:

• Experience with complex system implementations (e.g., general ledger, sub-ledger, accounting engine, reference data, reporting tools implementations a plus) on either 1LOD/2LOD.
• Experience with corporate functions applications (e.g. applications supporting Human Resources, Legal, Risk, Compliance, Corporate Treasury/accounting) on either 1LOD/2LOD.
• Experience with technical systems architecture and design, software development, and/or large data and analytics environments. 
• Experience with security protections and techniques in one or more of the following areas: applications, database, cloud, network infrastructure, and/or data.
• Experience with enterprise technology architecture as a holistic structure that includes people, process, and technology components combined to achieve business goals for automation.
• Experience leading operational risk reviews and capability assessments including identification of potential issues, and coordination with various teams including leadership.
• Experience in risk assessment and measurement of cloud applications, infrastructure components, and database management systems.
• Experience in security software development lifecycle including risk identification, assessments, and understanding of security testing.
• Experience with data management/security, data warehousing and big data environments.
• Experience with automated monitoring tools and incident tracking tools to effectively communicate and manage incidents, defects, and data quality issues.
• Plus if candidate has previous experience with emerging technologies including cloud technology, and AI/ML.

Competencies:

• Ability to interact with and influence people/groups of widely varying disciplines and backgrounds.
• Ability and confidence to exercise influence over a wide range of individuals at all levels of technical & business leadership.
• Strong presentation skills: able to use data to tell a clear, compelling story.
• Strong analytical and problem-solving skills.
• Comfortable with public speaking across various forums and be able to effectively and logically communicate when ideas are being challenged in an open forum.
• Comfortable interacting directly with technology executive leadership, including in a high stress environment.
• Understands the perspective of regulators and has the ability to develop messages and content to respond to the requirements.
• Strong planning, organization and time management experience that is strategically oriented, an innovative thinker, and a demonstrated and decisive decision maker.
• Able to collaboratively manage initiatives that span multiple geographic locations and time zones.
• Navigates organizational complexity; demonstrates organizational savvy.
• Builds partnerships across functions and regions; collaborates well with others.

Logistics:

• The role is global, and the incumbent must be proactive and capable of leading solutions to global issues with others in different regions and time zones.
• The successful candidate will need to be a hands-on, self-starter, and able to manage tasks/timelines for self and others.

Education:

• Bachelor’s/University degree, Master’s degree a plus.
• Related industry certifications.

About the Company:
Citi Private Bank