Compliance and Operational Risk Manager – Application Security and Technology Risk Oversight

Bank of America•Chicago, IL

6d•$97,200 - $230,000

About The Position

At Bank of America, the Compliance and Operational Risk Manager executes independent second line of defense compliance and operational risk oversight for Front Line Units, Control Functions, and third parties. The role ensures implementation of the Global Compliance and Operational Risk Management framework, policies, program, and procedures, and supports timely identification, assessment, escalation, and mitigation of risks. The manager provides oversight of high-risk technology environments, including Application and Technology Security Assessments, Technology Third Party Risk Management, and emerging technology risks. Serving as a trusted advisor and effective challenger to senior technology leaders, the role provides risk oversight, governance, and strategic advice in support of cybersecurity, operational resilience, and regulatory objectives. The position is based at the listed Bank of America locations in Chicago, Illinois, or Pennington, New Jersey, with a first shift schedule and 40 hours per week.

Requirements

At least 7 years of experience in operational risk, technology risk, information security, cybersecurity, compliance, audit, or related risk management disciplines, preferably within a large financial institution.
Expertise in cybersecurity, application security, technology governance, third-party technology risk management, or operational resilience.
Ability to influence and challenge senior leaders and executive stakeholders while maintaining effective partnerships.
Experience supporting regulatory examinations, audit engagements, issue remediation programs, and risk governance activities.
Background in risk-related disciplines and strong experience with the Global Compliance and Operational Risk program from a first- or second-line perspective.
Clear, impactful communication skills and comfort engaging with executive-level audiences and shaping outcomes.
Understanding of AI-related risks, governance considerations, cybersecurity implications, and technology-enabled solutions for risk management.
Familiarity with GCOR programs, Global Technology policies, and ITGPST processes and risks.
Skill in identifying, assessing, and remediating operational risks and issues.
Proficiency in generating actionable insights through data analysis and reporting tools.
Ability to build trust, challenge constructively, and partner effectively across the enterprise.
Proficiency in industry security frameworks such as NIST CSF and applicable laws, rules, and regulations.

Nice To Haves

Familiarity with Application Technology Security Assessments, vulnerability management, software development lifecycle controls, or application security testing programs.
Understanding of emerging technology risks, including AI governance, model risk considerations, and cybersecurity implications of AI-enabled technologies.
Professional certifications such as CISSP, CISM, CRISC, CISA, or equivalent risk and technology certifications.
Second- or third-line-of-defense experience, or experience in a business risk and controls role.
Strong familiarity with the Global Compliance and Operational Risk program and related tools or applications.
Familiarity with the Issues Management program and tools.
Demonstrated success leading targeted assessments, audits, or regulatory examination engagements, including authoring responses, report-outs, and observations.
Ability to challenge constructively and support opinions and recommendations with facts and data.
Demonstrated productive partnership with stakeholders across the enterprise at all levels.

Responsibilities

Assess risks and the effectiveness of Front-Line Unit processes and controls for compliance with applicable laws, rules, and regulations, and respond to regulatory inquiries, audits, and examinations.
Provide independent compliance and operational risk oversight of Front Line Unit or Control Function performance and related third-party or vendor relationships in accordance with enterprise policies, programs, and procedures.
Identify and escalate problems or issues, and drive actions to address root causes of compliance risk issues and operational risk losses.
Monitor inventories of processes, risks, controls, and related metrics against risk appetite and limits, and report compliance or regulatory activity violations.
Assist in developing independent risk management reporting for governance and management routines.
Analyze and interpret applicable laws, rules, and regulations to advise stakeholders and identify and manage risks.
Review and challenge Front Line Unit and Control Function processes, risks, Single Process Inventory, and Risk and Control Self-Assessments; monitor regulatory changes relevant to the area of coverage.
Monitor and assess adherence to Global Technology policies and standards.
Perform inline reviews of ITGPST issue management activities, including remediation of regulatory issues.
Provide independent second line oversight of the Application and Technology Security Assessment program, including control effectiveness, risk identification, issue management, and regulatory compliance.
Assess technology and cyber risks across critical applications, business processes, and technology environments.
Review and challenge risk acceptance decisions, remediation strategies, and control design related to application security risks.
Monitor emerging technology and AI-related risks, including evolving cyber threats, governance frameworks, and control environments.
Support executive reporting, governance routines, and strategic communications for senior leadership.
Evaluate adherence to enterprise risk management standards, technology policies, and regulatory expectations.
Partner with technology, cybersecurity, risk, audit, and business teams to strengthen operational resilience and risk management.