Portfolio Governance Lead, VP

State Street•Boston, MA

8h•$120,000 - $217,500

About The Position

The Portfolio Governance Lead provides centralized governance and execution oversight across a portfolio of Market applications. The role ensures technology risk, control remediation, regulatory commitments, and strategic remediation initiatives are effectively managed and reported. It maintains the integrated portfolio view, drives governance cadence, manages RAID and escalation processes, and gives senior leadership clear visibility into material risk exposure, remediation progress, emerging concerns, dependencies, and decisions required. The role oversees portfolio governance across 500+ applications, establishes consistent standards and reporting, and coordinates Risk Remediation Project Managers, application owners, cybersecurity, infrastructure, IAM, third-party risk, audit, and control teams. It produces executive dashboards and reporting, maintains portfolio-level risk, action, issue, and dependency tracking, and drives accountability for overdue actions and unresolved blockers. The position owns the Risk & Control governance cadence and oversees remediation plans and closure evidence. It challenges plans without credible milestones, ownership, dependencies, or target dates; monitors progress against agreed paths to green; and ensures items are not reported as closed until required evidence and validation are complete. Success is measured by risk outcomes, including reduced aged and overdue risks, credible remediation paths, fewer missed commitments, timely escalations, quality closure evidence, forecast accuracy, accountable ownership, timely dependency resolution, and accurate executive reporting.

Requirements

At least 7 years of experience in technology risk, program/project management, cybersecurity, infrastructure, audit, controls, or technology governance.
Experience managing large technology portfolios in a regulated environment.
Strong understanding of risk remediation, IAM/PAM, vulnerability management, infrastructure risk, third-party risk, audit, and regulatory commitments.
Strong executive communication and presentation skills.
Demonstrated ability to drive accountability across teams without necessarily having direct management authority.
Strong experience with RAID management, portfolio reporting, governance forums, dependency management, and executive escalation.

Nice To Haves

PMP, PRINCE2, Agile, ITIL, risk, or related professional certification.

Responsibilities

Maintain the integrated Risk & Control portfolio across 500+ applications.
Establish consistent governance standards, reporting requirements, milestones, and escalation criteria.
Coordinate activities across Risk Remediation Project Managers, application owners, cybersecurity, infrastructure, IAM, third-party risk, audit, and control teams.
Ensure priority risks have an accountable owner, path to green, target date, milestones, dependencies, and closure criteria.
Produce concise executive dashboards and portfolio-level reporting on material risk exposure, priority and overdue remediation, aging risks and control gaps, milestone slippage, forecast confidence, regulatory and audit commitments, vendor and platform dependencies, and required decisions or intervention.
Translate detailed remediation activity into senior-management reporting focused on exposure, trajectory, accountability, and required decisions.
Maintain the portfolio-level Risks, Actions, Issues and Dependencies (RAID) framework.
Identify systemic or cross-application risks that cannot be resolved within individual workstreams.
Track dependencies involving shared infrastructure, cybersecurity, IAM, vendors, funding, resources, and technology platforms.
Drive accountability for overdue actions and unresolved blockers.
Establish escalation thresholds for material exposure, missed commitments, regulatory deadlines, inadequate remediation plans, and unresolved dependencies.
Escalate issues through appropriate risk and technology governance forums.
Ensure escalations state the business or risk impact, accountable owner, corrective action, target date, blocker, and decision required.
Own and coordinate the Risk & Control governance cadence, including daily critical/P1 exception management, weekly portfolio remediation and execution review, biweekly high-risk and control-domain reviews, monthly Risk & Control Remediation Council, and quarterly executive portfolio and operating-model review.
Challenge remediation plans that lack credible milestones, ownership, dependencies, or target dates.
Monitor delivery against agreed paths to green.
Coordinate with control owners to ensure remediation evidence supports closure.
Ensure items are not reported as closed until required evidence and validation are complete.
Deliver the enterprise application Risk & Control portfolio dashboard, executive monthly reporting, integrated RAID and dependency register, governance calendar, decision and escalation log, remediation milestone reporting, aging and overdue-risk reporting, regulatory/audit commitment tracking, portfolio-level risk heatmaps, and executive briefing materials.

Benefits

401(k) retirement savings plan with company match.
Insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages.
Paid time off including vacation, sick leave, short-term disability, and family care responsibilities.
Access to an Employee Assistance Program.
Incentive compensation, including eligibility for annual performance-based awards (excluding certain sales roles subject to sales incentive plans).
Eligibility for certain tax-advantaged savings plans.
Inclusive development opportunities.
Flexible work-life support.
Paid volunteer days.
Employee networks.