Resilience Program and Technology Risk Manager

Catalyst Corporate Fede•Plano, TX

3h•Hybrid

About The Position

The Resilience Program & Technology Risk Manager primarily manages Catalyst’s Enterprise Resilience Program, ensuring its ongoing execution, maintenance, and regulatory readiness in accordance with applicable requirements and industry guidance. Enterprise Resilience is the role’s primary accountability and takes precedence over technology risk responsibilities when priorities compete. The position also performs technology-focused risk management activities within the Enterprise Risk Management function, including IT and cybersecurity risk assessments, control evaluations, and third-party technology risk analysis. The role manages the resilience lifecycle, including product and service impact analysis, business impact analyses, risk assessments, recovery strategies, Resilience Plans, exercises, incident support, and program governance. It also leads and supports IT and technical risk assessments, evaluates technology controls, incorporates IT and cybersecurity considerations into operational risk assessments, provides technical risk analysis for third-party risk reviews, and supports the administration and continued development of Fusion Risk Management. The manager is expected to maintain working knowledge of cyber resilience, including ransomware preparedness, response, recovery, and restoration of critical services following destructive cyber events. In partnership with Information Technology and Information Security, the role evaluates cybersecurity controls and recovery capabilities but is not responsible for designing or implementing those controls. The position works with business units, Information Technology, Information Security, Internal Audit, and management to identify risk, evaluate controls and recovery capabilities, document remediation, and provide governance reporting. The position is a full-time, permanent hybrid opportunity for someone local to Plano, Texas.

Requirements

Bachelor’s degree in Business, Information Technology, Information Security, Computer Science, or a related field; applicable work experience may be considered in lieu of the education requirement.
Three to five years of relevant experience in enterprise resilience, business continuity, IT risk management, information security, IT audit, operational risk, or a related field; financial-services experience is preferred.
Working knowledge of enterprise and operational resilience, business continuity, disaster recovery, incident response, and cyber resilience, including ransomware preparedness, response, recovery, and restoration of critical services.
Working knowledge of IT general and application controls, cybersecurity and technology-risk frameworks such as NIST CSF, ISO 27001, and COBIT, and associated risks involving access management, cloud/SaaS, third-party technology, data protection/privacy, and related IT operations.
Ability to identify and assess inherent and residual risks, evaluate control design and effectiveness, and document risk conclusions, recovery capabilities, control gaps, remediation requirements, and risk acceptance decisions.
Advanced analytical, problem-solving, organizational, and project-management skills, including the ability to manage multiple assessments, exercises, incidents, and program deliverables concurrently.
Strong written and verbal communication skills, including the ability to translate technical and resilience concepts into business-focused risk language, effectively challenge stakeholders, and collaborate across departments.
Proficiency with generative AI tools, including Microsoft Copilot or comparable platforms, for research, analysis, information synthesis, and workflow efficiency; understanding of responsible AI usage, information security, data confidentiality, and the need to validate AI-generated outputs.

Nice To Haves

Working knowledge of applicable FFIEC, NCUA, and other regulatory guidance affecting financial institutions, including technology, information security, authentication/access, business continuity, cyber resilience, and third-party risk expectations.
Professional certification in business continuity, resilience, risk management, IT audit, or information security, such as CBCP, CRISC, CISA, CISM, CISSP, CCSP, or comparable credentials.
Experience evaluating technology recovery capabilities, including IT disaster recovery plans, recovery procedures, ransomware recovery strategies, and validation through exercises or testing.
Experience assessing third-party technology and cybersecurity risks, including reviewing SOC reports, penetration tests, and other security assurance documentation.
Experience administering or enhancing GRC/ERM platforms, preferably Fusion Risk Management, including operational resilience capabilities, workflows, reporting, dashboards, and Salesforce-based administration.
Experience using Microsoft Power Platform tools, including Power Automate, Power Apps, and Power BI, SharePoint, or comparable technologies to automate business processes, integrate systems, analyze data, and improve reporting.
Experience developing or configuring AI agents, including Microsoft Copilot Studio or comparable agentic AI solutions.

Responsibilities

Manage Catalyst’s Enterprise Resilience Program and ensure its ongoing execution, maintenance, and regulatory readiness.
Manage the resilience lifecycle, including product and service impact analysis, business impact analyses, risk assessments, recovery strategies, Resilience Plans, exercises, incident support, and program governance.
Lead and support IT and technical risk assessments and evaluate technology controls.
Incorporate IT and cybersecurity considerations into operational risk assessments.
Provide technical risk analysis in support of third-party risk reviews.
Support the administration and continued development of Fusion Risk Management.
Maintain working knowledge of cyber resilience, including ransomware preparedness, response, recovery, and restoration of critical services following destructive cyber events.
Partner with Information Technology and Information Security to evaluate cybersecurity controls and recovery capabilities; the role does not design or implement those controls.
Work with business units, Information Technology, Information Security, Internal Audit, and management to identify risks, evaluate controls and recovery capabilities, document remediation, and provide governance reporting.

Benefits

Federal holidays, vacation, sick time, parental leave, and time off for volunteering.
401(k) retirement savings plan with matching and company contributions.
Flexible health and insurance options, including medical, dental, and vision insurance.
Long- and short-term disability insurance, life insurance, supplemental life and AD&D insurance, and a flexible spending account.
Family-friendly policies and practices; the company has been named a “Best Place for Working Parents” since 2021.
Credit union membership.
Casual work environment.
Paid covered parking.
Onsite fitness facility with showers.
Access to onsite services, including a massage therapist and personal trainer, car wash and detail service, vehicle refueling service, and food delivery service.