Principal Technical Risk Analyst
About The Position
Serves as the highest-level individual contributor responsible for interpreting and developing solutions to complex, cross-departmental technical risk and control challenges with significant organizational impact. Operates independently as a recognized subject matter expert across IT and operational environments. Leads moderate to large risk and control initiatives, drives standardization and audit alignment, and influences enterprise control design, structure, and testing. Works with senior management and second- and third-line partners to improve the maturity, quality, and defensibility of the risk and control program. Mentors analysts, reviews documentation, and enhances team practices, procedures, and methodology. The role also serves as a technical subject matter expert on Enterprise Technology Services processes in complex environments. It translates technical processes and system behavior into audit-aligned control language, partners across risk, audit, compliance, and security functions, and continually improves risk and control frameworks, tools, and methodology.
Requirements
- Extensive experience in technical risk management, control testing, cybersecurity, or IT governance, operating independently as a recognized expert.
- Demonstrated ability to lead moderate to large cross-departmental projects and initiatives with significant organizational impact.
- Advanced hands-on experience designing, documenting, and testing controls, including TOD/TOE, sampling and population management, and evidence alignment in accordance with established methodologies.
- Expert knowledge of risk management principles and frameworks such as ISO, NIST, and COSO, and regulatory compliance requirements for financial institutions.
- Advanced understanding of IT systems, network architecture, cloud technologies, IAM, endpoint, configuration management, and cybersecurity.
- Experience aligning control documentation with Information Security and enterprise technology (ETP) standards and internal and external audit expectations.
- Demonstrated ability to develop and enhance practices, procedures, templates, and training adopted across teams.
- Excellent analytical, problem-solving, and decision-making skills, including the ability to navigate ambiguity and challenge assumptions.
- Strong interpersonal and communication skills, including the ability to explain complex technical risk concepts to senior management and non-technical stakeholders.
- Ability to mentor and develop staff at all levels and build strong cross-functional relationships with business and senior partners.
- Bachelor’s degree in information technology, Computer Science, Risk Management, or a related field, or an equivalent combination of training, education, and experience.
- Must be authorized to work in the United States without current or future sponsorship.
Nice To Haves
- Master’s degree in a related field, or an equivalent combination of training, education, and experience.
- Certified Information Systems Security Professional (CISSP).
- Certified Risk and Information Systems Control (CRISC).
- Project Management Professional (PMP).
- Certified Information Systems Auditor (CISA).
Responsibilities
- Interpret and develop solutions to complex, cross-functional technical risk and control challenges with significant enterprise impact.
- Independently lead moderate to large risk and control assessments and initiatives, managing multiple simultaneous, high-impact engagements from planning through delivery.
- Elevate control testing to audit-level granularity to improve program maturity, audit readiness, and end-to-end control identification.
- Influence control design decisions, provide senior oversight, and challenge assumptions to create audit-defensible controls.
- Develop, enhance, and standardize practices, procedures, templates, and instructions adopted across teams.
- Drive consistency, standardization, and rationalization of controls across assessments, aligning documentation with Information Security, ETP, and applicable regulatory standards.
- Translate complex technical processes and system behavior into clear, audit-aligned control language for technical and business stakeholders.
- Serve as the recognized technical subject matter expert on Enterprise Technology Services processes in complex environments.
- Lead engagements through risk assessments, control walkthroughs, compliance documentation, and defensible testing results.
- Partner with second-line risk, Internal Audit, ICFR, Compliance, and Security to support holistic risk management and reliable, reusable control results.
- Mentor and develop analysts at all levels, transfer knowledge, and raise the risk function’s capabilities.
- Facilitate workshops, walkthroughs, and training sessions to enhance risk awareness and promote program best practices.
- Continuously evaluate and enhance risk and control frameworks, tools, and methodology in response to evolving technology and threats.
- Anticipate and proactively address issues, communicate courageously, and adapt to feedback to deliver results that meet stakeholder expectations.
- Promote proactive, audit-aligned risk management and model the Leadership Model in all interactions.
- Remain cognizant of and adhere to Navy Federal policies, procedures, and regulations pertaining to the Bank Secrecy Act.
Benefits
- Highly competitive pay.
- Generous benefits and perks.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Principal
