Audit & Regulatory Management (ARM) Manager

Sumitomo Mitsui Banking Corporation•Charlotte, NC

31d•Hybrid

About The Position

SMBC is seeking a hands-on Audit & Regulatory Management (ARM) Manager to join the ARM team, which manages audit and regulatory requirements for the Information Security team at JRI-A. This is not an auditor role; an auditor, assessor, or similar background is a plus. The ARM Manager leads one audit or multiple sections of a larger audit, coordinating and facilitating the process from start to finish, or tracking remediation through closure-pack preparation. The role ensures audit requests are managed efficiently, appropriate evidence is gathered, and responses are tracked and delivered on time. The manager also oversees stakeholder relationships and assigns and reviews work completed by junior team members. The ARM Manager manages audit requests, evidence review, interviews, documentation and artifact requests, walkthroughs, meetings, follow-up queries, issue-closure packs, and management review and approval. The role communicates with auditors, evidence providers, control owners, senior management, and subject matter experts; explains and advocates for relevant controls; reviews preliminary findings; and tracks audit issues to closure. The manager also maintains the ARM evidence repository and central ARM tool, supports accurate status reporting, contributes to continuous improvement of the ARM Program, ensures adherence to ARM processes and standards, keeps documentation current, and develops and delivers training on ARM processes and tools. SMBC uses a hybrid workforce model that allows employees to work from home and from an SMBC office. Employees must live within a reasonable commuting distance of their office. Candidates will learn their specific hybrid schedule during the interview process; hybrid work may not be available for certain roles.

Requirements

Bachelor’s degree in information technology, information security, or a related field.
More than 5 years of IT audit, assurance, or consulting experience.
Strong knowledge of General IT Controls, risk, and best practices, particularly in information security.
Strong knowledge of IT auditing concepts, audit processes, and audit types.
Strong knowledge of cybersecurity regulations, such as NYS DFS Cybersecurity, GDPR, and FCA, and information security frameworks and best practices, such as ISO 27002, FFIEC, and NIST.
Detailed, thorough, and diligent technical ability, with good analytical skills and a customer-service mindset.
Strong written, verbal, and interpersonal communication skills, including the ability to articulate points clearly and communicate persuasively.
Self-motivated and disciplined approach to learning and working.
Ability to show initiative and innovation and independently manage ARM assessments and related activities from start to finish.
Ability to own complex tasks and drive projects to timely completion.
Excellent time-management skills and the ability to prioritize, multitask, and manage multiple projects simultaneously.

Nice To Haves

Big Four IT audit experience is preferred.
Information security or IT risk designations such as CISA, CISSP, CISM, or CRISC.
Auditor, assessor, or similar professional background.

Responsibilities

Lead a single audit or take responsibility for multiple sections across a group of audits.
Coordinate and facilitate audits from start to finish, or manage remediation progress tracking through closure-pack preparation.
Manage audit requests and evidence review, ensuring appropriate artifacts are collected and responses are tracked and delivered on time.
Assign and review work of junior team members and escalate issues promptly to keep deliverables on track.
Coordinate audit activities, including interviews, documentation and artifact requests, walkthroughs, meetings, follow-up queries, issue-closure packs, and management review and approval.
Communicate with auditors to clarify controls and requests, and explain requests, risks, and controls to evidence providers and control owners.
Explain and advocate for key controls and identify compensating controls to auditors and stakeholders.
Engage with auditors on preliminary findings, review findings for plausibility and reasonableness, and consult control owners, senior management, and subject matter experts as applicable.
Track audit issues to closure against action milestones and provide periodic status updates to Information Security Management.
Maintain the ARM Evidence Repository and collect reusable evidence in advance where possible.
Promote use of the central ARM tool, keep audit status information current, and review dashboard metrics for accuracy.
Participate in ARM Program expansion and continuous-improvement projects, leading assigned aspects and directing ARM Specialist and ARM Senior Specialist work.
Ensure adherence to ARM processes and standards, identify and implement improvements, share best practices, and keep documentation up to date.
Create training materials on ARM processes and tools and lead education initiatives for Information Security team members.
Independently complete ARM activities requested by management, clients, auditors, and regulators.