AI Risk Officer Manager

Bank of Montreal•Chicago, IL

1d•Onsite

About The Position

This role involves overseeing, monitoring, and reporting on information and technology risks for a designated portfolio. The manager is responsible for developing and monitoring the risk management and governance framework and practices across BMO to manage these risks, ensuring adherence to policies, standards, methodologies, and controls for increased transparency, accuracy, and consistency. Key functions include working with stakeholders to implement risk methodologies, metrics, and program standards, acting as a trusted advisor to business groups, and guiding in issue identification and classification. The position requires influencing and negotiating to achieve business objectives, recommending solutions, assisting in strategic planning, and identifying emerging issues and trends. The manager will independently assess the information and technology risk profile, interpret new regulations, and lead the development and maintenance of the governance system and framework. Other responsibilities include coordinating database management, building change management plans, defining communication strategies, assessing training needs, and leading the monitoring and reporting of the risk governance program. The role also involves managing governance meetings, providing input into operational programs, designing and implementing core business processes, and administering risk program activities. The manager will review new initiatives for potential risks, provide advice on risk framework implementation, and coordinate oversight activities. Building effective relationships with internal and external stakeholders is crucial for providing second-line defense risk management support. The position requires managing databases for analysis and visualization, analyzing data for insights and recommendations, and maintaining tools and templates for various risk programs. The manager must develop and maintain in-depth knowledge of business, risk management requirements, and regulatory directives, and is expected to work independently on non-routine situations, providing specialized consulting and analytical support.

Requirements

Typically between 5 - 7 years of relevant experience.
Post-secondary degree in related field of study or an equivalent combination of education and experience.
In-depth knowledge of information and technology risk management practices.
In-depth knowledge of the designated business / product portfolio.
In-depth knowledge of regulatory requirements.
In-depth knowledge of quantitative techniques and economic capital methodologies.
In-depth knowledge and experience with risk policy frameworks; quality control / testing frameworks.
Deep knowledge and technical proficiency gained through extensive education and business experience.
Verbal & written communication skills - In-depth.
Collaboration & team skills - In-depth.
Analytical and problem solving skills - In-depth.
Influence skills - In-depth.
Data driven decision making - In-depth.

Nice To Haves

Degree in Information Technology, Computer Science, Business Administration, or related field of study preferred.
Completion of a Security related certification preferred (e.g. CISSP, CISA, CISM, GIAC).

Responsibilities

Oversees, monitors, and reports on information and technology risks for a designated portfolio.
Develops and monitors the risk management and governance framework and practices leveraged across BMO to manage information and technology risks.
Develops and monitors adherence to policies, standards, methodologies, and controls that increase transparency, accuracy, and consistency across groups.
Works with stakeholders to implement the methodology, metrics, and program standards for the assigned portfolio to ensure compliance, effective monitoring, timely reporting, and identify action plans.
Acts as a trusted advisor to assigned business/group.
Guides/assists in the identification and classification of issues; recommends action plans.
Influences and negotiates to achieve business objectives.
Recommends and implements solutions based on analysis of issues and implications for the business.
Assists in the development of strategic plans.
Identifies emerging issues and trends to inform decision-making.
Researches existing or emerging requirements and related best practices to develop recommendations for changes/enhancements.
Independently assesses the information and technology risk profile (e.g. exposures, material initiatives, systems issues or weaknesses in the control structure) for the assigned portfolio.
Assists with the interpretation of new or changing regulations and assesses impacts to governance frameworks.
Helps determine business priorities and best sequence for execution of business/group strategy.
Conducts independent analysis and assessment to resolve strategic issues.
Leads the development and maintenance of the governance system and framework.
Ensures alignment between stakeholders.
Represents the risk program / governance structure during internal/external regulatory audits and/or examinations.
Breaks down strategic problems, and analyses data and information to provide insights and recommendations.
Coordinates the management of databases; ensures alignment and integration of data in adherence to data governance standards.
Builds change management plans of varying scope and type; leads or participates in a variety of change management activities including readiness assessments, planning, stakeholder management, execution, evaluation and sustainment of initiatives.
Leads or participates in defining the communication plan designed to positively influence or change behaviour; develops tailored messaging; and identifies appropriate distribution channels.
Assesses education and training needs to develop and deliver training.
Leads and integrates the monitoring, measurement, and reporting on the status of the information and technology risk governance program to internal and external stakeholders.
Leads the management of governance meetings and maintenance of governing body mandates, oversight, and approval guidelines.
May provide specialized support for other internal and external regulatory requirements.
Provides input into the planning and implementation of ongoing operational programs in support of the information and technology risk framework.
Leads/participates in the design, implementation and management of core business/group processes.
Administers and maintains technology and information security and management risk program activities adhering to applicable policies, procedures, and established processes.
Reviews new business initiatives and monitors existing initiatives to identify potential risk situations/ impacts; makes recommendations or escalates as per guidelines.
Identifies potential risk situations / impacts and makes recommendations or escalates.
Provides advice and guidance to assigned business/group on implementation of the risk framework, including effective challenge.
Coordinates and participates in the execution of oversight/governance activities including reporting; assessment of education & training needs, development/delivery of training; development and execution of regulatory administration processes & procedures.
Consults with stakeholders to improve consistency and transparency of risk measurement, metrics and reporting.
Supports the development and maintenance of the governance system and framework including supporting policy/standard/operating procedures lifecycle management, education and training assessments.
Builds effective relationships with internal/external stakeholders e.g. business stakeholders and corporate support areas to provide second line of defense information and technology risk management support.
Manages databases and provides support for analysis, forecasting and/or data visualization, ensuring adherence with data governance standards.
Analyzes data and information to provide insights and recommendations; includes identification of risk impacts for new processes and workflows related to initiatives.
Maintains tools and templates for information and technology risk programs and standards e.g. Risk Control Self Assessment (RCSA), Sarbanes-Oxley (SOX), business continuity planning standards and policies for internal and third-party solution development.
Develops and maintains in-depth knowledge of business and related risk management requirements and legislative/ regulatory directives and guidance.
Builds effective relationships with internal/external stakeholders.
Analyzes data and information to provide insights and recommendations.
Exercises judgment to identify, diagnose, and solve problems within given rules.
Works independently and regularly handles non-routine situations.
Broader work or accountabilities may be assigned as needed.