Senior Analyst , Testing - IT/Cyber Risk

Ally Bank•Detroit, MI

20h•Hybrid

About The Position

The IT/Cyber Risk Senior Analyst works within Ally’s Technology, Security, and Data Risk Team and serves as a lead contributor for the Asset Class testing function. The role plans, coordinates, and executes risk-based testing of complex technology and infrastructure controls to assess whether controls are appropriately designed and operating effectively to mitigate risk. The analyst independently handles all aspects of control testing, including scoping, walkthroughs, evidence evaluation, control assessment, issue development, and communicating results to stakeholders. The position is based in Ally’s Detroit office, with a few days in the office each week and some remote work. The successful candidate evaluates technology and cybersecurity risks, collaborates with technical and business stakeholders, and manages multiple priorities while demonstrating strong analytical, organizational, and communication skills. The role also provides technical guidance and mentorship to other team members.

Requirements

At least 3 years of experience.
High school diploma or GED equivalent.
Experience performing IT audit, IT risk management, information security, or technology control testing activities.
High proficiency in infrastructure testing, including operating systems, databases, and cloud technologies, and control reviews in areas such as identity and access management, patch management, vulnerability management, and network security.
Experience performing risk-based assessments and evaluating technology controls in alignment with FFIEC guidance and industry frameworks.
Strong written and verbal communication skills, including the ability to explain technical risks, control deficiencies, and remediation recommendations to technical and non-technical stakeholders.
Strong attention to detail and the ability to research, analyze, and evaluate information to support risk-based conclusions.
Ability to work independently, manage tasks autonomously, prioritize responsibilities, and achieve objectives.

Nice To Haves

Experience in the banking industry.
A bachelor’s degree in a relevant field of study.
Experience with industry frameworks such as NIST, COBIT, ISO 2700x, and PCI-DSS.
An industry designation such as CISA, CISSP, or CRISC.

Responsibilities

Lead the Asset Class testing function within IT Risk.
Guide walkthroughs with infrastructure, security, and engineering teams to understand technology processes, challenge control design, and evaluate risk-mitigation activities.
Design testing objectives and approaches, and independently test complex technology and infrastructure controls.
Assess the design and operating effectiveness of key technology controls, including compliance with enterprise policies, standards, regulatory requirements, and industry frameworks.
Evaluate evidence and document test results to support informed, objective opinions about risk exposure.
Draft testing observations about areas for improvement or control deficiencies and recommend actions to technical and business stakeholders verbally and in writing.
Provide technical guidance, mentorship, and subject matter expertise to members of the Technology, Security, and Data Risk Team.
Identify emerging technology risks and lead stakeholder discussions to determine whether risks should be entered into the IT risk register.

Benefits

Market-competitive base pay and pay-for-performance incentives based on personal and company goals.
Paid time off starting at 20 days, 11 paid holidays, and 8 hours of annual volunteer time off.
401(k) retirement savings plan with matching and company contributions.
Student loan pay-down and 529 educational savings assistance programs.
Tuition reimbursement and an employee stock purchase plan.
Medical, dental, and vision insurance options.
Employee, spouse, and child life insurance, short- and long-term disability coverage, and a pre-tax Health Savings Account with employer contributions.
Healthcare Flexible Spending Account and critical illness, accident, and hospital indemnity insurance.
Total well-being program supporting physical, social, emotional, and financial well-being.
Adoption, surrogacy, and fertility assistance.
Paid parental and caregiver leave.
Dependent Day Care FSA, backup child and adult/elder care days, and childcare discounts.
Employee assistance program and employee discount programs.
Potential travel allowances, relocation assistance, signing bonus, and/or equity, depending on the role.