IT Risk and Governance Manager

S&T Bank•Pittsburgh, IN

4d•$75,000 - $184,800•Onsite

About The Position

The IT Risk and Governance Manager oversees the governance, risk management, compliance, and control framework for the Information Technology organization. The role serves as an embedded risk advisor, ensuring regulatory, risk, security, and control requirements are incorporated into technology planning, solution design, project delivery, and ongoing operations. It is the primary liaison between Information Technology and Enterprise Risk Management, Compliance, Internal Audit, Information Security, Legal, and regulatory agencies. The manager maintains the IT governance framework, coordinates audits and examinations, evaluates control effectiveness, and drives process improvements and automation to optimize controls and support operational efficiency, business growth, and risk-informed decision-making. The role also provides oversight and guidance for technology initiatives, emerging technologies, vendor and cloud risks, policies, risk assessments, exceptions, remediation, and governance reporting. The position is based at either 324 N. 4th Street, Indiana, Pennsylvania, or 358 N Shore Dr, Pittsburgh, Pennsylvania. The schedule is Monday through Friday, 8:00 a.m. to 5:00 p.m., with additional hours as necessary to meet departmental objectives. Travel to alternate work locations and overnight stays are each indicated at 10–20% of the time.

Requirements

Four-year college degree in Information Technology, Cybersecurity, Information Systems, Risk Management, Business Administration, or a related discipline.
Five to ten years of general experience.
Five to ten years of specialized experience.
Experience in banking or financial services technology risk management, including IT governance, IT audit, regulatory examinations, information security governance, third-party technology risk management, policy administration, cloud and SaaS governance, and emerging technology risk management, including artificial intelligence and automation.
Strong analytical, problem-solving, and organizational skills.
Ability to navigate situations where the path forward may not be immediately clear.
Ability to maintain effective working relationships with stakeholders across multiple locations.

Nice To Haves

CRISC (Certified in Risk and Information Systems Control).
CISA (Certified Information Systems Auditor).
CGEIT (Certified in the Governance of Enterprise IT).

Responsibilities

Evaluate and address technology risks in alignment with the Bank’s risk appetite, strategic objectives, and regulatory requirements.
Serve as the subject matter expert for IT governance, risk management, policy administration, audit coordination, and regulatory compliance.
Advise technology teams throughout the technology lifecycle, including project initiation, solution selection, implementation planning, and retirement.
Establish and administer governance reviews for new technology initiatives, major system changes, and strategic technology investments.
Provide governance and risk oversight for significant technology initiatives, implementations, standards, and strategic investments.
Lead governance and risk management for artificial intelligence, intelligent automation, and other emerging technologies, including use-case reviews, risk assessments, acceptable-use standards, compliance monitoring, and control recommendations.
Coordinate across Information Technology, Enterprise Risk Management, Compliance Risk Management, Audit, Security, Legal, and regulatory agencies.
Maintain and enhance the IT governance framework in alignment with business objectives, risk standards, regulatory requirements, and industry best practices.
Oversee the inventory, ownership, review schedules, and lifecycle management of IT policies, standards, and procedures.
Coordinate IT participation in audits, regulatory examinations, and risk assessments; gather evidence, facilitate meetings, and track remediation.
Assist management with audit responses, corrective action plans, and remediation timelines.
Partner with Security to assess technology control design and effectiveness and recommend enhancements.
Identify opportunities to optimize controls through standardization, process improvement, automation, and technology capabilities.
Maintain the IT risk register and monitor risk treatment plans, policy exceptions, and remediation activities through resolution.
Coordinate and support IT Risk and Control Self-Assessments (RCSAs), documenting risks, controls, control owners, and mitigation strategies.
Facilitate review, documentation, approval, monitoring, and reporting of technology risk acceptances, policy exceptions, compensating controls, and remediation plans.
Coordinate governance oversight, risk assessment, remediation tracking, and reporting for technology incidents, control failures, compliance gaps, and audit findings.
Provide technology risk oversight for vendor selection, third-party solutions, cloud services, and strategic technology partners.
Provide risk insights, reporting, analysis, and recommendations to IT leadership and management committees.
Develop and deliver education, awareness, and training on risk management, governance, compliance, control responsibilities, and policy adherence.
Coordinate collection, analysis, and reporting of KRIs, KPIs, audit findings, policy exceptions, and other governance metrics.
Coordinate the Executive Technology and Operations Committees (ETOC) and Technology and Operations Committee (TOPCO), including presentations, dashboards, analysis, recommendations, and follow-up actions.
Monitor and interpret banking regulatory developments, FFIEC guidance, emerging risks, and industry practices, translating them into actionable technology governance, policy, control, and operational improvements.
Advise IT leadership on delivering technology solutions while maintaining governance, effective controls, and regulatory compliance.
Lead cross-functional initiatives to improve risk management maturity, governance practices, operational effectiveness, and the IT control environment.
Perform ad hoc risk, governance, compliance, audit-related analysis, and special projects as requested by senior management.
Use analytical, problem-solving, and organizational skills to navigate situations where the path forward may not be immediately clear.
Maintain effective stakeholder relationships across multiple locations, managing up when necessary and recognizing the give-and-take nature of partnership.