Sr. Manager, Information Technology and Information Security Risk Job at Tier4 Group (Reston)

Job Description

Sr. Manager, Information Technology and Information Security Risk Hybrid Work Schedule- 3 days onsite in Reston, VA SUMMARY OF POSITION: The Information Technology and Information Security Risk (IT/IS) Sr. Manager plays a critical enterprise-wide role in overseeing cybersecurity, technology, data, AI and information security risk governance. This role partners with the Chief Risk Officer (CRO) and the Enterprise Risk Management team in identifying, assessing, and monitoring the organization’s technology and cybersecurity risk profile to ensure alignment with the our client’s strategic objectives, risk appetite, and regulatory expectations. This role has broad ownership and visibility across the enterprise and serves as a key second-line risk partner to senior leadership, business lines, IT, Information Security, Compliance, and third-party vendors. The Senior Manager will help ensure adherence to regulatory expectations from agencies such as FHFA, FFIEC, OCC, FDIC, SEC, and FINRA. This person will partner with business lines, IT, and compliance teams to maintain a strong security posture and reduce exposure across critical financial systems and third-party relationships, strengthening the organization’s overall cyber resilience and operational risk management framework. Core Responsibilities Evaluate and provide independent challenge regarding the alignments of the organization’s IT and IS strategy with enterprise business objectives, risk appetite, and regulatory expectations. Review and assess the adequacy of information technology and security risk assessments across applications, infrastructure, and business processes. Partner with IT project teams to influence decisions related to technology architecture, cybersecurity controls, system implementations, and operational risk mitigation strategies Evaluate new and existing systems, platforms, and SAAS integrations for cybersecurity risks and regulatory compliance impacts. Conduct third party and vendor security risk assessments, including review of SOC 1/SOC 2 reports, SIG questionnaires, penetration testing results, and remediation plans to ensure vendor information security practices align with OF expectations. Provide effective second-line oversight and credible challenge related to cybersecurity incidents, operational disruptions, and emerging technology risks, including analysis of potential impacts to customer data, financial systems, and regulatory obligations. Collaborate with business units and technology teams to identify, document, and monitor risks, ensuring remediation activities meet regulatory timelines and internal risk appetite. Oversee the implementation of information technology and security risk management policies and the Cyber-Security Incident Response Plan Conduct cyber security awareness training and education through periodic email phishing tests, in-person and computer-based training, presentations to employees, and security related tabletop exercises. Monitor the status of remediation for IT and IS related issues and ensure that the remediation documentation is complete and adequate. Monitor cybersecurity and financial sector threat intelligence; communicate emerging risks to leadership. Oversee IT and IS key risk indicators (KRIs) and maintain clear and accurate dashboards and reporting metrics for senior management, risk committees, and regulators Ability to analyze complex technical environments and communicate risk in business-focused terms. Strong knowledge of information security frameworks including NIST CSF, NIST 800‑53, ISO 27001, CIS Controls. Effective communication skills for interacting with auditors, examiners, and senior management. PREFERRED SKILLS AND EXPERIENCE: Bachelor’s degree in Information Security, Cybersecurity, Risk Management, or related fields (or equivalent work experience) preferred. 8–10 years of relevant experience in information security or risk management roles with experience in financial services, banking, payments, fintech, or related regulatory environments preferred. Experience with data analytics and visualization tools (e.g., Power BI, Tableau, or Python). Experience working in a regulated financial services or technology environment. CRISC, CISSP, CISM, Security+ or CGEIT or similar certifications

Job Responsibility

Evaluate and provide independent challenge regarding the alignments of the organization’s IT and IS strategy with enterprise business objectives, risk appetite, and regulatory expectations
Review and assess the adequacy of information technology and security risk assessments across applications, infrastructure, and business processes
Partner with IT project teams to influence decisions related to technology architecture, cybersecurity controls, system implementations, and operational risk mitigation strategies
Evaluate new and existing systems, platforms, and SAAS integrations for cybersecurity risks and regulatory compliance impacts
Conduct third party and vendor security risk assessments, including review of SOC 1/SOC 2 reports, SIG questionnaires, penetration testing results, and remediation plans to ensure vendor information security practices align with OF expectations
Provide effective second-line oversight and credible challenge related to cybersecurity incidents, operational disruptions, and emerging technology risks, including analysis of potential impacts to customer data, financial systems, and regulatory obligations
Collaborate with business units and technology teams to identify, document, and monitor risks, ensuring remediation activities meet regulatory timelines and internal risk appetite
Oversee the implementation of information technology and security risk management policies and the Cyber-Security Incident Response Plan
Conduct cyber security awareness training and education through periodic email phishing tests, in-person and computer-based training, presentations to employees, and security related tabletop exercises
Monitor the status of remediation for IT and IS related issues and ensure that the remediation documentation is complete and adequate
Monitor cybersecurity and financial sector threat intelligence
communicate emerging risks to leadership
Oversee IT and IS key risk indicators (KRIs) and maintain clear and accurate dashboards and reporting metrics for senior management, risk committees, and regulators
Ability to analyze complex technical environments and communicate risk in business-focused terms
Strong knowledge of information security frameworks including NIST CSF, NIST 800‑53, ISO 27001, CIS Controls
Effective communication skills for interacting with auditors, examiners, and senior management

Requirements

Bachelor’s degree in Information Security, Cybersecurity, Risk Management, or related fields (or equivalent work experience) preferred
8–10 years of relevant experience in information security or risk management roles with experience in financial services, banking, payments, fintech, or related regulatory environments preferred
Experience with data analytics and visualization tools (e.g., Power BI, Tableau, or Python)
Experience working in a regulated financial services or technology environment
CRISC, CISSP, CISM, Security+ or CGEIT or similar certifications

Chief Country Compliance Officer Sr Mgr

Oversees the Citi Compliance Risk Management Program for a medium to smaller fra...

Location

Bahamas , Nassau

Salary:

Not provided

Citi

Expiration Date

Until further notice

Requirements

Credibility as a subject matter expert and experience of dealing with issues that have a high impact at all levels of the organization
Experience of working with key country level regulators and industry associations
Knowledge of local regulatory requirements and obligations and the ability to identify emerging compliance issues and themes
An ability to influence senior business leaders on all compliance risk-related matters affecting the business. The individual should have the ability to independently challenge, when needed, while at the same time being supportive and solution-based and not being perceived as obstructive
An ability to be “hands on” and “in the trenches” with the direct team, while also bringing a sense of strategic vision and a global sensibility to the function
Ability to navigate and negotiate through conflicting demands to maintain focus on priority objectives while ensuring key stakeholders’ needs are met
Strong team leadership, communication, interpersonal and management skills, with a track record of leading through change and the ability to effectively communicate the strategic vision to various stakeholder groups
Effective negotiation skills, a proactive and “no surprises” approach in communicating issues and strength in sustaining independent views. Strong presentation and relationship management and influencing skills are essential
The ability to thrive and execute in a complex, highly matrixed, global environment
Bachelor’s Degree highly preferred or relevant, equivalent experience. Preference for post graduate degree and/or recognized professional qualifications where applicable. Professional qualifications may include: CRMC or equivalent, CPA, ACA, CIA, CFA, ACAMS, etc. strong technical knowledge of compliance regulations and requirements, experience within a highly complex, global financial institution, regulator or related industry participant.

Job Responsibility

Annual Country Compliance Plan: Preparing, obtaining approval and successfully completing an annual compliance risk management plan, in accordance with the global template and content and presentation requirements, setting out how compliance risk will be managed within the jurisdiction and its constituent parts, and the role to be played by ICRM in order to achieve the plan. Identification of the jurisdictional requirements, accountabilities and the process ownership and monitoring and testing ownership, as well as the determination of suitable staffing, hours required and secured budget in order to achieve the state of compliance within risk appetite will be set out in the plan, which will be reviewed quarterly with the jurisdictional CCC and ICRM, as well as any applicable legal entity, as well as where required by applicable regulatory agencies. The annual country compliance plan must take into consideration the applicable compliance risk assessments and MCAs appropriate to the jurisdiction and its activities.
State of Compliance Reporting: Preparing quarterly, in accordance with the approved global format, and in adherence to all established requirements for the State of Compliance reporting. The State of Compliance report will be presented to the appropriate CCC, BRCC and legal entity Board or Board Audit Committee, or other such Board committee required within the jurisdiction.
Enhancing Governance: Providing a valued interactive program of support and compliance risk management services covering the assessment and reporting of Key Compliance Risks across products, services, functions, legal entities, service centers and the jurisdiction as a whole. Providing stakeholders with insight and practical solutions as well as credible challenge to improve the ethical control culture, and conduct risk environment. Timely reporting of significant local regulatory issues to local, overseas, regional, and global stakeholders. Same-day escalation of regulatory reports received. Maintaining on-going assessment and reporting of the State of Compliance through the relevant corporate governance committees such as country audit committee(s) and/or subsidiary board(s), country coordinating committee and business risk management committee, and other management body(ies). Key Activities Compliance Risk Culture:
Stakeholder Support and Relationships: Developing senior management relationships, including with legal entity management focus, inclusive of non-executive directors (where they exist in the jurisdiction), and the CCO as well as product functional and entity/service center line management. Informing senior management and directors of subsidiary boards, and the country/business management of significant compliance matters that require their attention or action. Proactively anticipate and help the business and functions plan for changes in the compliance and regulatory environment in the country. Provide support to compliance programs and country/business management on policy interpretation and “gray area” exposures. Build and maintain strong relationships with other functional leads, including Legal, Risk Management, including Operational Risk Management, and Internal Audit to create a supportive and seamless compliance and ethical control culture and an appropriate conduct risk environment. Key Activities Processes and Activities:
Regulatory Management and Coordination: Supporting the Citi Country Officer (CCO) in the management and development of regulatory relationships. Coordinating as the key interface with regulators on compliance risk management issues and supervisory exam management matters. Providing same day notification of regulator correspondence to Citi Compliance Officer, Regulatory Liaison and Exam Management CCO and ICRM COO. Providing leadership, coordination and regular interaction with the [insert country] authorities on behalf of ICRM and the Citi franchise. Record regulator correspondence and minutes of regulator meetings on Citi system in line with the Global Regulatory Exam Management Governance and Process Standards. Ensuring prompt recording of, responses to, and escalation of regulatory queries, notices of violations and breaches, any forbearance, and concerns identified. Deliver to regulators and supervisors a valued interactive program of support and assurance in accordance with requirements and appropriate expectations on compliance issues, trends, themes, root cases and impacts relating to governance, regulatory risk management and internal control issues. The overall objective is to earn the regulator’s trust and to establish a strong, independent and professional regulatory relationship across the franchise.
Regulatory Inventory: Ensuring prompt identification, logging in, evaluation and formulation of a plan to address requirements arising from new and amended laws, regulations, rules and other requirements and expectations from regulatory and enforcement authorities.
Regulatory Change Management and Controls: Ensuring that the regulatory change management requirements and processes, along with the regulatory control framework for existing requirements, are effectively operating within the country with respect to the identification, impact assessment and implementation of all applicable laws, regulations, rules and related processes, controls and reporting that impact Citi activities in the jurisdiction.
Anti-Money Laundering Compliance Risk Management (ACRM): Providing strategic direction, oversight, coordination and cooperation in respect of the country’s Anti-Money Laundering compliance risk management program. Partner closely and with the Head of ACRM to ensure a strong linkage between ICRM and ACRM.
Independent Compliance Risk Management (Program and Product/Service/Function focused*): Providing direction and oversight in supporting the ICRM teams in the country related to local requirements and the applicable extraterritorial laws, regulations, relevant Citi policies, standards, and global procedures. Deliver consistent application of program procedures and be accountable to program owners consistent with the ICRM methodology and CRM Framework. *Programs include but are not limited to: Sanctions
Anti Bribery

Fulltime

Select Country

Sr. Manager, Information Technology and Information Security Risk

Job Description

Job Responsibility

Requirements

Looking for more opportunities?

Sr. Manager, Information Technology and Information Security Risk

Sr. Manager, Intellectual Property Security

Sr. Security Operations Engineer

Sr. Director, Information Security Officer (Global Payment Networks)

Sr. Risk Operations Analyst

Sr Director of Information Security

Infosec Architect

Chief Country Compliance Officer Sr Mgr

Sr. Information Security Administrator

Our AI answers in your language