Business Controls Senior Associate - Privacy GLBA/PCI

Fifth Third Bank•Cincinnati, OH

1d•$82,100 - $172,500•Onsite

About The Position

As a first line of defense, provides specialized Business Controls support focused on identifying, assessing, mitigating, monitoring, and managing privacy, information protection, and regulatory risks, with particular emphasis on the Gramm-Leach-Bliley Act (GLBA) and Payment Card Industry Data Security Standard (PCI DSS). Responsible for coordinating and conducting GLBA Risk Assessments, supporting PCI Report on Compliance (ROC) efforts across applicable lines of business, and planning and executing internal PCI assessments. Partners with lines of business to evaluate privacy and data protection risks, assess the design and effectiveness of controls, identify gaps, and support the development and implementation of appropriate remediation. Serves as a subject matter expert for GLBA, PCI, and related privacy risk and control requirements, providing guidance to business partners and working closely with Legal, Compliance, Enterprise Risk, Information Security, Technology, Audit, and other key stakeholders. Monitors changes in applicable laws, regulations, standards, and regulatory guidance and assists the business in understanding and incorporating those requirements into business processes and controls. Supports Business Controls in advancing privacy risk management practices, processes, assessments, reporting, and tools within the organization's Enterprise Risk Management (ERM) framework. Develops and presents meaningful risk information and insights to stakeholders to support informed decision-making and effective management of privacy and data protection risks. Responsible and accountable for risk by openly exchanging ideas and opinions, elevating privacy, security, and control concerns, and following established policies and procedures. Operates within the Bank's and lines of business' established risk appetites while consistently identifying, assessing, managing, monitoring, and reporting privacy, data protection, and related operational risks.

Requirements

Specialized Business Controls support focused on identifying, assessing, mitigating, monitoring, and managing privacy, information protection, and regulatory risks, with particular emphasis on the Gramm-Leach-Bliley Act (GLBA) and Payment Card Industry Data Security Standard (PCI DSS).
Coordinating and conducting GLBA Risk Assessments.
Supporting PCI Report on Compliance (ROC) efforts across applicable lines of business.
Planning and executing internal PCI assessments.
Evaluating privacy and data protection risks.
Assessing the design and effectiveness of controls.
Identifying gaps and supporting the development and implementation of appropriate remediation.
Serving as a subject matter expert for GLBA, PCI, and related privacy risk and control requirements.
Providing guidance to business partners.
Working closely with Legal, Compliance, Enterprise Risk, Information Security, Technology, Audit, and other key stakeholders.
Monitoring changes in applicable laws, regulations, standards, and regulatory guidance.
Assisting the business in understanding and incorporating those requirements into business processes and controls.
Advancing privacy risk management practices, processes, assessments, reporting, and tools within the organization's Enterprise Risk Management (ERM) framework.
Developing and presenting meaningful risk information and insights to stakeholders.
Operating within the Bank's and lines of business' established risk appetites.
Consistently identifying, assessing, managing, monitoring, and reporting privacy, data protection, and related operational risks.
Providing expertise and analysis related to the identification, assessment, control, monitoring, testing, and reporting of privacy and information protection risks.
Evaluating business processes involving the collection, use, storage, transmission, sharing, retention, and protection of sensitive information.
Maintaining awareness of evolving privacy laws, GLBA requirements, PCI DSS standards, regulatory guidance, and industry practices.
Assisting in evaluating their applicability and potential impact to business processes and controls.
Supporting regulatory change management activities related to privacy, GLBA, PCI, and information protection requirements.
Identifying control breakdowns, inadequate processes, and unexpected events involving privacy or protected information.
Supporting the resolution of privacy, GLBA, PCI, information-security, Audit, Compliance, and Risk Management issues.
Identifying root causes and development and monitoring of remediation activities.
Establishing appropriate business ownership of privacy-related processes, risks, controls, assessments, testing, and remediation activities.
Building effective relationships with Legal, Compliance, Enterprise Risk, Information Security, Technology, Audit, other Business Controls organizations, and lines of business.
Providing guidance related to appropriate controls for protecting sensitive information.
Supporting efforts to ensure information is handled in accordance with applicable privacy, GLBA, PCI, and internal policy requirements.
Supporting RCSA and other ERM processes by helping identify and assess privacy and information protection risks and controls.
Identifying appropriate risk indicators, thresholds, monitoring activities, and reporting related to privacy, GLBA, PCI, and information protection risks.
Supporting issue management and remediation activities involving privacy or payment-card information.
Evaluating privacy and information-protection considerations associated with third-party and supplier relationships.
Providing privacy and regulatory risk expertise for new products, processes, technology implementations, business changes, and other initiatives.
Gathering and analyzing assessment results, control information, issues, and other risk data.
Identifying trends, recurring control weaknesses, and opportunities to strengthen the organization's privacy and data protection control environment.
Developing and presenting clear and actionable reporting regarding GLBA assessments, PCI compliance activities, privacy risks, control gaps, issues, and remediation efforts.
Maintaining complete and accurate assessment documentation.
Supporting appropriate recordkeeping within applicable governance, risk, and compliance systems.
Participating in special initiatives involving privacy, GLBA, PCI, information protection, regulatory requirements, or emerging risk.

Responsibilities

Leads and coordinates GLBA Risk Assessments for applicable lines of business, including identification and evaluation of privacy and information protection risks, controls, potential gaps, and remediation needs.
Supports the organization's PCI Report on Compliance (ROC) activities across applicable lines of business, including coordination of assessment activities, evidence collection, control validation, documentation, and engagement with business stakeholders and the external Qualified Security Assessor (QSA).
Plans, coordinates, and executes internal PCI assessments to evaluate compliance with applicable PCI DSS requirements and the effectiveness of associated business processes and controls.
Serves as a Business Controls subject matter expert for GLBA, PCI, and related privacy and data protection requirements, providing guidance and interpretation to lines of business and other stakeholders.
Partners with business leadership to develop and implement controls, policies, procedures, and sustainable processes designed to effectively manage privacy, GLBA, PCI, and data protection risks.
Provides expertise and analysis related to the identification, assessment, control, monitoring, testing, and reporting of privacy and information protection risks.
Evaluates business processes involving the collection, use, storage, transmission, sharing, retention, and protection of sensitive information to identify potential privacy, GLBA, and PCI-related risks and control gaps.
Maintains awareness of evolving privacy laws, GLBA requirements, PCI DSS standards, regulatory guidance, and industry practices, and assists in evaluating their applicability and potential impact to business processes and controls.
Supports regulatory change management activities related to privacy, GLBA, PCI, and information protection requirements to help ensure applicable changes are identified, assessed, communicated, and incorporated into business practices.
Identifies control breakdowns, inadequate processes, and unexpected events involving privacy or protected information and partners with Business Controls leadership and lines of business to develop appropriate corrective actions.
Supports the resolution of privacy, GLBA, PCI, information-security, Audit, Compliance, and Risk Management issues, including identification of root causes and development and monitoring of remediation activities.
Partners with lines of business to establish appropriate business ownership of privacy-related processes, risks, controls, assessments, testing, and remediation activities.
Builds effective relationships with Legal, Compliance, Enterprise Risk, Information Security, Technology, Audit, other Business Controls organizations, and lines of business to promote consistent interpretation and execution of privacy and data protection requirements.
Provides guidance related to appropriate controls for protecting sensitive information and supports efforts to ensure information is handled in accordance with applicable privacy, GLBA, PCI, and internal policy requirements.
Supports RCSA and other ERM processes by helping identify and assess privacy and information protection risks and controls, including evaluation of inherent and residual risk where applicable.
Partners with lines of business and Risk partners to identify appropriate risk indicators, thresholds, monitoring activities, and reporting related to privacy, GLBA, PCI, and information protection risks.
Supports issue management and remediation activities involving privacy or payment-card information, including root cause analysis, corrective action development, documentation, escalation, and monitoring through resolution.
Evaluates privacy and information-protection considerations associated with third-party and supplier relationships where applicable, including identification of potential GLBA and PCI impacts and associated controls.
Provides privacy and regulatory risk expertise for new products, processes, technology implementations, business changes, and other initiatives that may affect the collection, management, transmission, or protection of customer or payment-card information.
Gathers and analyzes assessment results, control information, issues, and other risk data to identify trends, recurring control weaknesses, and opportunities to strengthen the organization's privacy and data protection control environment.
Develops and presents clear and actionable reporting regarding GLBA assessments, PCI compliance activities, privacy risks, control gaps, issues, and remediation efforts to Business Controls leadership and other stakeholders.
Maintains complete and accurate assessment documentation and supports appropriate recordkeeping within applicable governance, risk, and compliance systems.
Participates in special initiatives involving privacy, GLBA, PCI, information protection, regulatory requirements, or emerging risk, as assigned by Business Controls or line-of-business leadership.