Associate Principal, Operational Risk Management, IT & Security

The OCC•Chicago, IL

11d•Hybrid

About The Position

The Associate Principal provides critical support to the Director of Operational Risk in evaluating IT and Security risks, conducting risk assessments, and applying the risk management framework across the process, risk, and control universe. The role collaborates with IT, Security, TPRM, Legal, Compliance, and Internal Audit to strengthen the organization’s management of IT and Security risk. The position leads risk intake and IT and Security risk assessments, maintains risk inventories and taxonomies, and supports compliance with regulatory requirements and expectations. It executes risk identification, analysis, and enterprise assessments aligned with NIST and COBIT frameworks, using RSA Archer, JIRA, and ServiceNow. It also develops AI governance assessment protocols and AI risk registers aligned with the NIST AI Risk Management Framework. Additional responsibilities include auditing technology programs using Distributed Ledger Technology (DLT), reviewing Identity and Access Management (IAM) controls and access governance, communicating assessment results to committees and leaders, maintaining ORM methodologies and materials, and tracking internal findings, external examination issues, and business-area self-identified issues. Up to 40% telecommuting is permitted. OCC describes the work environment as hybrid, with up to two remote-work days per week.

Requirements

Bachelor’s degree in computer science, information systems, business information technology, or a related field.
Three years of experience as an operational risk management associate, security intern, project manager, or in a related role.
Work experience executing risk identification, analysis, and enterprise risk assessments aligned with NIST and COBIT frameworks and regulatory requirements using RSA Archer, JIRA, and ServiceNow.
Work experience developing AI governance assessment protocols and AI risk registers aligned with the NIST AI Risk Management Framework using RSA Archer, JIRA, and ServiceNow.
Work experience auditing DLT technology programs, including requirements traceability, vendor entitlement configurations, and architectural integration risks, using SpiraTest, SailPoint, and RSA Archer.
Work experience administering and reviewing IAM controls and access governance processes, including RBAC, user and entitlement reviews, least-privilege controls, and group-based access policies, using tools such as Microsoft Active Directory, ManageEngine ADManager Plus, and Microsoft 365 Admin Center.

Responsibilities

Support the Director of Operational Risk in evaluating IT and Security risks through risk assessments and application of the risk management framework.
Collaborate with IT, Security, TPRM, Legal, Compliance, and Internal Audit to strengthen organization-wide management of IT and Security risk.
Lead the OCC risk identification and assessment process (Risk Intake) for IT, Security, and business risks, and verify the consistency and reliability of related frameworks and systems.
Promote adherence to methodologies, guidance, and standards for risk identification and assessment frameworks.
Maintain risk inventories, taxonomies, and other components supporting IT and Security risk management and compliance activities.
Lead and execute IT and Security risk assessments aligned with the risk and control universe and regulatory requirements and expectations.
Execute risk identification, analysis, and enterprise risk assessments aligned with NIST and COBIT frameworks and regulatory requirements, using RSA Archer, JIRA, and ServiceNow.
Develop AI governance assessment protocols covering onboarding risk analysis, control gap evaluations, and continuous monitoring; create AI risk registers aligned with the NIST AI Risk Management Framework.
Audit DLT technology programs, including requirements traceability, vendor entitlement configurations against contractual obligations, and architectural integration risks in clearing and settlement environments.
Administer and review IAM controls and access governance processes, including RBAC, user access reviews, entitlement reviews, least-privilege controls, and group-based access policies.
Communicate risk assessment results to governance committees, business owners, and leadership at various levels.
Collaborate on enhancing and maintaining ORM program methodologies, policies, procedures, and job aides, including developing new program activities.
Track and update ORM team internal findings, external examination issues, and business-area self-identified issues resulting from Enterprise Risk Assessment.