AVP, Operational Risk – Information Technology Oversight

Synchrony•Boston, MA

1d•$90,000 - $155,000•Hybrid

About The Position

The Operational Risk Management team is part of the 2nd Line of Defense (2LOD) within Synchrony. This role is responsible for performing independent operational risk oversight of information technology within Synchrony. This includes assessing and monitoring risks related to IT programs, adoption of emerging technologies and 3rd party risks specific to the IT function. The position reports to the VP, Information Technology Oversight.

Requirements

Bachelor’s degree with 5+ years of information technology and/or data analytics experience in financial services or a banking institution .
Strong understanding of operational risks in Technology including software obsolescence, application design to meet resiliency (performance and availability) requirements achieving business demands

Nice To Haves

Familiarity with information security and risk management concepts
Proven analytical skills with strong attention to detail and quality control of work product
Experience in financial services or banking industry with understanding of financial services regulatory environment
Experience in IT operations and/or application support
Experience with data sourcing and reporting processes with ability to design and implement new analytical capabilities
Experience with Internal Audits and/or Regulatory Exams and preparing materials to respond to external inquiries providing evidence and rationales and reasoning for provided materials
Proven experience working in an ambiguous environment with proven ability to explain complex concepts and support points of view
Strong presentation and communication skills (written and oral) with proven experience interacting with all levels of the organization
Experience writing formal findings to Senior levels of Management
Proficiency in PC tools (Microsoft Suite, including: Word, Excel and PowerPoint)
Excellent interpersonal skills - ability to foster relationships and create informal networks, both internal and external
Curiosity with the ability to learn new concepts

Responsibilities

Engage the Information Technology organization in reviewing and assessing operational risks in the selection, deployment and use of new technologies being introduced into the Synchrony Technology Stack. This includes the re-use of existing technology being leveraged in new ways to solve business problems
Monitor risks being accepted by the business and provide an independent assessment of the risk-taking activities
Perform formal assessments of technology risks using common processes within Risk Management, including Targeted Reviews, Concurrent Reviews and Continuous Monitoring
Independently investigate potential risks being taken by Information Technology teams and escalate through ORM processes
Monitor Cloud Computing and Public Cloud Service activities related to AWS, Azure to develop control objectives based on regulatory guidance and assess the risks in Synchrony’s deployment of these technologies
Contribute to and validate delivery on Alpha, Beta and General Availability requirements for Cloud and new technology certifications across IT teams (Applications and Infrastructure). Confirm evidence provided for each certification and ongoing sustainability of requirements for each phase.
Attend and represent 2LOD at various forums, including but not limited to: Cloud Design Authority (CDA), Architecture Review Board (ARB), Enterprise Architecture Forum, and Program Increments (PI) sessions for various sprint teams (Cloud, Security, etc.),
Review risks within IT third-party supplier base with consideration for unique risks based on the vendor relationship and services (e.g., purchased software, software as a service, service providers, staff augmentation, etc.)
Manage risks and issues within the Synchrony’s enterprise governance application (eGRC)
Perform other duties and/or special projects as assigned
Support 2nd Line of Defense processes such as the Enterprise Risk Assessment (ERA) and Risk and Control Self-Assessment (RCSA) processes