Enterprise Data and Tool Risk Analyst

City National Bank of Florida•Coral Gables, FL

About The Position

The Enterprise Data and Tool Risk Analyst supports the Data Risk Oversight and Tools Risk Management Director in fulfilling the Director’s responsibilities within Enterprise Risk Management. The role supports day-to-day administration of City National Bank’s Tool Risk Management Program, including maintenance of the enterprise tool inventory, attestations, classification, validation coordination, change management monitoring, and reporting on Critical and Material tools. It also supports the Director’s independent second-line-of-defense oversight, review, and challenge of the Bank’s Data Management Program, including governance, classification, quality, certification, usage, privacy, sharing, and retention and disposal standards. Working under the Director’s direction, the analyst performs analysis, testing, and documentation; prepares evidence, metrics, and reporting packages; and coordinates with first-line tool owners, Data Domain Owners, and Data Stewards. The role calls for a data analytics or data engineering background, hands-on experience with data tools and End User Computing / User-Developed Applications (EUC/UDA), and an interest in data governance and regulatory expectations for risk data aggregation and reporting.

Requirements

2–4 years of work experience in data analytics, data engineering, data management/governance, model/tool risk management, operational risk, or internal audit; preferably within financial services.
1–2 years of experience testing or reviewing tools or spreadsheets, performing control testing, or supporting a data management, data quality, or EUC/UDA program.
Hands-on experience sourcing, transforming, analyzing, and interpreting data to support risk and business decisions.
Experience reviewing or building analytical tools, reports, and dashboards, with the ability to assess design, logic, and control effectiveness.
Experience with Python, SQL, and R.
Experience with Microsoft Fabric, Azure, and Snowflake.
Knowledge of ETL/ELT pipelines and pipeline orchestration, data modeling and warehouse architecture, and data quality and validation.
Experience with Power BI, Tableau, and SAS.
Knowledge of tool/model risk management concepts, including tool identification, materiality and complexity classification, validation, and conclusion/grading systems.
Familiarity with EUC/UDA controls, including inventory, risk tiering, documentation, access, version control, change management, and periodic revalidation.
Ability to assess tool design, input data quality and integrity (ETL), syntax/code correctness, control environment, and tool use and reporting.
Understanding of Data Management Core Requirements, including classification, data quality dimensions, metadata/lineage, access controls, and retention under GLBA/SOX, and BCBS 239 principles for verifying data used by tools.
Familiarity with metadata management, business glossaries, data lineage and traceability, and data catalog tooling such as Collibra.
Familiarity with data classification and handling, data privacy and sharing controls, retention schedules, legal holds, and secure disposal requirements.
Understanding of data certification, User Acceptance Testing, and preventive controls within data pipelines.
Understanding of data governance roles, including Data Governance Councils, Data Management Offices, Data Domain Owners, and Data Stewards.
Ability to test data quality dimensions (accuracy, completeness, timeliness, consistency, validity, uniqueness) and analyze data quality scorecards and exception reporting.
Working knowledge of change management, access control (RBAC, UARs), and vendor risk management controls for internal and third-party tools.
Strong analytical, documentation, and communication skills, including the ability to respectfully challenge first-line owners and articulate findings to management.
Detail-oriented and execution-oriented, with the ability to manage multiple validations and program activities to deadlines.
Bachelor’s degree in Finance, Data Analytics, Information Systems, Computer Science, Mathematics/Statistics, Risk Management, or a related field.

Nice To Haves

Professional risk, data, or analytics certifications, such as CDMP, CRISC, CISA, or Microsoft Power BI Data Analyst (PL-300), or progress toward them.

Responsibilities

Maintain Tool Risk Management Program governing documents, procedures, and templates, and draft updates for the Director’s review.
Maintain the enterprise tool inventory, ensuring information on use, ownership, location, risk classification, and validation status is complete and accurate; track tools through development, use, and retirement.
Execute annual tool ownership attestations by distributing requests, tracking responses, following up with owners, and identifying new, changed, or retired tools.
Perform initial model-versus-tool identification and preliminary tool classification using documented materiality and complexity criteria, for review and approval by the Director in coordination with the Model Risk Management Manager.
Analyze proposed risk classifications and validation timing from tool owners, documenting observations for the Director’s review and challenge.
Support interdisciplinary risk assessments for tools such as RPAs (bots) and AI Agents before implementation; gather information and prepare materials for the technology change management committee and AI Working Group.
Maintain the Tool Validation Schedule, track required validations of Critical and Material tools, and flag significant changes or increased risks that may trigger additional validations.
Perform or support tool validation activities, including review of tool design, input data, control effectiveness, benchmarking, independent recalculations, and tool use and reporting.
Test access governance over tool data, including role-based access control, least privilege, and completion of periodic User Access Reviews.
Prepare and organize validation workpapers and evidence for each Critical and Material tool for the Director’s review.
Review Critical and Material tool documentation for completeness against Tool Risk Program requirements and follow up with tool owners on gaps.
Maintain the Master Tool Change Log and support coordination with the Enterprise Technology change committee on tool change risk assessments and approvals.
Test tool owners’ change logs for compliance, including department approvals and final production verification.
Test EUC/UDA controls, including inventory completeness, documentation, version control, access restrictions, and periodic revalidation.
Support creation and reporting of KRIs, KPIs, and program metrics for the tool risk program.
Perform analysis and testing of data governance structures, standards, and controls in support of the Director’s independent second-line oversight of the Data Management Program.
Assist with second-line reviews of data management policies and standards by preparing comparisons, gap analyses, and draft comments.
Review first-line self-assessments, control evidence, and remediation plans; document observations and potential issues for the Director’s challenge.
During tool validations, perform data lineage and traceability testing to confirm critical report figures can be traced to an authoritative source of record.
Track tool and data findings, action plans, reschedules, and delayed items under the Enterprise Issues Management Policy, and prepare supporting documentation for risk acceptances.
Collect data and produce KRIs, KPIs, and program metrics for the tool risk and data management programs, including dashboards and reporting packages for the Operational Risk Committee, MERC, and BERC.
Record and maintain tool and data risks, issues, and related evidence on the Bank’s enterprise risk / GRC platform.
Support internal and external audits and regulatory examinations by compiling inventories, evidence, and documentation, and assist in monitoring regulatory developments, including FFIEC, GLBA, SOX/FDICIA, and BCBS 239.