Director, Technology Risk

FactSet•Boston, MA

3d•$200,000 - $260,000

About The Position

FactSet creates flexible, open data and software solutions for over 200,000 investment professionals worldwide, providing instant access to financial data and analytics that investors use to make crucial decisions. At FactSet, our values are the foundation of everything we do. They express how we act and operate, serve as a compass in our decision-making, and play a big role in how we treat each other, our clients, and our communities. We believe that the best ideas can come from anyone, anywhere, at any time, and that curiosity is the key to anticipating our clients’ needs and exceeding their expectations. FactSet Research Systems Inc. is a global provider of integrated financial information, analytical applications and industry-leading services for investment and corporate communities. As a publicly traded company (NYSE:FDS | NASDAQ:FDS) on the S&P 500 index, FactSet delivers superior content, analytics, and flexible technology to help more than 207K users see and seize opportunity sooner. For over 40 years, the company has served financial professionals, which include portfolio managers, investment research professionals, investment bankers, risk and performance analysts, wealth advisors and corporate clients. FactSet gives our clients the edge to outperform with informed insights, workflow solutions across the portfolio lifecycle, and industry-leading support from dedicated specialists. The company has been included in FORTUNE’s 100 Best Companies to Work For, Best Workplace in the United Kingdom and France and most recently Best Places to Work 2023 by Glassdoor.

Requirements

15+ years of technology experience, including 7+ years in technology risk, IT risk management, or a related discipline within a global Fintech, Financial Services, or enterprise technology organization.
Proven experience building or significantly maturing a technology risk practice, including risk frameworks, taxonomies, assessment methodologies, governance structures, and risk registers.
Strong command of risk quantification methods, including qualitative scoring models and quantitative approaches such as FAIR (Factor Analysis of Information Risk), and the ability to translate risk data into clear investment cases and prioritization decisions.
Deep expertise across key technology risk domains, including infrastructure resilience, application and platform health, third-party and vendor risk, data risk, operational risk, and technology change risk.
Demonstrated success embedding risk-based thinking into technology portfolio management and investment decision-making processes, working in close partnership with finance, product, and engineering leadership.
Familiarity with enterprise risk management frameworks such as COSO, ISO 31000, or COBIT, and the ability to integrate technology risk into broader organizational risk governance.
Strong understanding of technology portfolio concepts including business criticality, service dependencies, technical debt, application lifecycle, and platform health.
Experience presenting technology risk posture, investment priorities, and risk remediation progress to executive leadership, Audit Committees, and Boards.
Exceptional communication and influencing skills, with the ability to translate complex technical risk concepts into clear business language and compelling investment narratives for non-technical stakeholders including executive management and the Board.
Experience with risk management tooling and GRC (Governance, Risk & Compliance) platforms, with the ability to define tooling requirements and drive adoption across a large technology organization.

Nice To Haves

Relevant certifications such as CRISC (Certified in Risk and Information Systems Control), CGEIT, or equivalent risk management credentials are preferred.
Bachelor’s degree in Computer Science, Information Systems, Engineering, Finance, or a related field is preferred.
Advanced degrees (MBA or MS in a technology or risk-related discipline) are valued but not required.

Responsibilities

Establish and lead FactSet’s technology risk function, including the frameworks, methodologies, tools, governance, and team required to identify, assess, prioritize, and manage risks across the technology portfolio.
Define a technology risk taxonomy and scoring model that incorporates both risk severity and portfolio importance (business criticality, revenue contribution, customer dependency, and strategic alignment), to enable consistent and defensible investment prioritization.
Enable risk-based investment decisions by producing clear, quantified risk profiles that connect technology risks to business outcomes and inform remediation, modernization, and operational spend.
Partner with engineering, platform, and product leaders to conduct regular risk assessments across infrastructure resilience, application and platform health, third-party and vendor dependencies, data risk, and technology change risk.
Build and maintain a centralized technology risk register that tracks identified risks, risk owners, ratings, remediation plans, progress, and residual risk levels, providing a single source of truth for FactSet’s technology risk posture.
Establish governance forums and reporting cadences that provide the CTO, executive leadership, and the Board with timely, actionable insight into technology risk posture, trends, and key risk indicators.
Define, track, and report on key risk indicators (KRIs) and key performance indicators (KPIs) for technology risk, to enable proactive monitoring and early detection of emerging risks.
Embed technology risk considerations into architecture decisions, technology roadmaps, platform modernization initiatives, and major change programs in partnership with the Chief Information Security Officer and engineering leadership.
Lead technology risk assessments for significant investments, platform adoptions, vendor selections, and major change programs, providing structured risk perspectives to support go/no-go and prioritization decisions.
Partner with Legal, Compliance, Finance, and Internal Audit to align the technology risk function with regulatory requirements and FactSet’s broader enterprise risk management (ERM) framework.
Build, develop, and retain a high-performing technology risk team, fostering a culture of analytical rigor, intellectual honesty, and strong business partnership.
Develop and deliver technology risk literacy programs to help engineers and business leaders understand and engage with technology risk as a strategic management tool, not only a compliance exercise.