Director, Audit & Regulatory Liaison

Royal Bank of Canada•Toronto, ON

1d•Onsite

About The Position

This role leads the Audit and Regulatory Liaison pillar of the Wealth Management Technology (WMT) 1B risk management function. It is a technical leadership role with 2 direct reports, requiring an expert understanding of cyber security risk management. The role provides control and advisory services to application development, support teams, and the Wealth Management Business. Services provided cover IT & operational risk analysis, risk & compliance exposure reporting, risk awareness & advisory, and regulatory response.

Requirements

10+ years experience evaluating general computing controls (e.g. logical access, patch & configuration management, change & incident management, etc.)
Expert communication (verbal and written) skills, including strong appreciation of relationship management
Expert knowledge of the global financial regulatory landscape (e.g. OSFI, FRB, NYDFS, FINRA, OCC)
Strong knowledge in IT and operational risk management processes, methods and tools
Strong technical knowledge and experience covering the operating systems (e.g. Unix, Windows, zOS) and database systems (e.g. Oracle, SQL Server, DB2)
CRISC Certification
CISA Certification

Nice To Haves

CISSP certification
CCSP or CCSK Certifications or demonstrable knowledge
Knowledge of GRC tools (e.g. ServiceNow, Archer)

Responsibilities

Lead audit and regulatory engagement by coordinating with stakeholders to ensure evidence is submitted on time, management receives early issue indication, and remediation activities are completed within SLA timelines. Scope includes periodic audits, regulatory exams, and the annual Wealth Management internal audit plan.
Lead US Wealth Technology risk management by serving as the central focal point for all USWM IT risk activities. Partner with the broader WMT risk management team to identify, escalate, and ensure adequate management of technology risks across the US Wealth Management technology stack.
Monitor and report on regulatory compliance by leading preparation and execution of various internal and external, periodic regulatory presentations.
Assess application criticality by leading a comprehensive review of WMT applications to determine SOC1, SOX, and Crown Jewel applicability, with ongoing documentation and remediation tracking.
Own operational risk program execution, including leading Risk and Control Self Assessments, coordinating control testing across WMT, and maintaining compliance documentation.
Build strategic partnerships by developing and maintaining collaborative relationships with Audit and Group Risk Management teams to improve process efficiency and reduce remediation cycles.