Job Description:

Job Description:

The Risk, Compliance, and Oversight team within the CAPE Cloud Business and Engagement Office is seeking a driven, experienced, and dynamic professional to help drive and optimize our Cloud Governance, Compliance, and Audit capabilities! You will partner with the CAPE Product Areas and Teams to further develop and integrate Governance, Compliance, and Audit practices and processes with focus on the key role that CAPE controls play in audits and other strategic programs and certifications. You will collaborate with various CAPE Squads to perform proactive audit and control assessments, monitor technology controls, document, and coordinate remediation plans, participate in Corporate Audits, and provide External Audit support. You will engage closely with the CAPE squads on their cloud migration strategies, data governance and oversight frameworks, and other new technologies (including AI and Large Language Models), and engage with CAPE leadership and the Operational Risk, and External Audit teams.

• 12+ years of experience in technology risk, cyber security, controls, or audit roles.
• Bachelor's degree in computer science, technology, or a related field of study preferred.
• Your excellent verbal and written communication skills allows you to prepare and present recommendations to senior management and concisely share and gain consensus for new insights, influence decisions and make sound, compelling arguments.
• Attention to detail with logical reasoning, analytical and critical-thinking and creative problem-solving skills.
• Experience in identifying risk metrics and developing management views to help prioritize work and identify real-time trends or anomalies.
• Ability to identify risk, quantify impact, and drive risk mitigation/remediation across BUs, IT teams and risk partners.
• Experience performing risk assessments, control assessments, IT audits or implementing controls for large scale financial service organizations (distributed, network and cloud environments).
• Knowledge of cloud security, controls, and technology environments (AWS/Azure, SaaS, PaaS, and IaaS).
• Experience working with third party auditors, audit standards and cybersecurity frameworks (e.g., SOX, SOC2, ISO 2700x, CIS Controls, CSA Cloud Control Matrix, HIGHTRUST, etc.)
• Professional technology risk certifications (e.g., CISSP, CISA, CRISC, CISM) and/or Cloud Certification(s) (CCSP, CCSK, AWS) preferred.
• Experience performing risk assessments, control assessments, IT audits or implementing controls for large scale financial service organizations (distributed, network and cloud environments).
• Knowledge of Governance, Risk, and Compliance (GRC) tools, such as Archer or Open Pages is preferred.
• Your technical knowledge includes a thorough understanding of the cloud and on-prem technology services.

• You can demonstrate a complete understanding of information technology processes and controls and a comprehensive understanding of risk, quality control and assurance functions.
• Your love of solving sophisticated problems, and comfort with ambiguous situations, and your ability to find innovative ways to mitigate risk using your sophisticated analytical and critical thinking skills.
• Ability to mentor and train other team members to work effectively in the risk, security, and audit roles.

• Evaluating control completeness by performing control design and operating effectiveness reviews and peer reviewing as needed.
• Conducting in depth information technology compliance assessments including detailing controls, identifying potential gaps and/or inconsistencies and making sound recommendations for improvement and/or mitigation.
• Assist with conducting risk assessments and readiness reviews for applications and workloads on the public cloud environment.
• Assist with supervising monitoring controls related to cloud and emerging technologies and to meet applicable security, audit, regulatory requirements.
• Crafting appropriate critical metrics (KRIs) for IT compliance monitoring. Understanding and consulting on information security standards and industry best practices.
• Lead IT controls program activities: this includes documenting controls in GRC and performing IT controls testing to meet internal assurance and external audit requirements.
• Liaison between internal and external audit, tracking of internal and external audit findings, perform issue follow-up, consulting and action plans with owners and issue resolution.