Senior Analyst , Testing - IT/Cyber Risk

Ally•Detroit, MI

7d•$85,000 - $150,000•Hybrid

About The Position

The IT/Cyber Risk Senior Analyst works within Ally Financial’s Technology, Security, and Data Risk Team and serves as a lead contributor for the Asset Class testing function. The role plans, coordinates, and executes risk-based testing of complex technology and infrastructure controls to assess whether controls are appropriately designed and operating effectively to mitigate risk. The analyst independently handles testing activities from scoping and walkthroughs through evidence evaluation, control assessment, issue development, and communicating results to stakeholders. The role requires evaluating technology and cybersecurity risks, collaborating with technical and business stakeholders, and managing multiple priorities. The analyst also provides technical guidance and mentorship to team members, documents objective test results, develops observations and recommendations, and leads discussions about emerging technology risks. The position is based in Ally’s Detroit office, with work in the office a few days per week and some remote work. Specific work requirements may be discussed during hiring and may change based on leadership discretion or business needs.

Requirements

At least 3 years of experience; the minimum qualifications specify 3+ years of experience.
High school diploma or GED equivalent.
Experience performing IT Audit, IT Risk Management, Information Security, or Technology Control Testing activities in complex enterprise environments.
Proficiency in infrastructure testing, including operating systems, databases, and cloud technologies, and in reviewing controls such as identity and access management, patch management, vulnerability management, and network security.
Experience performing risk-based assessments and evaluating technology controls in alignment with FFIEC guidance and frameworks such as NIST, COBIT, ISO 2700x, and PCI-DSS.
Strong written and verbal communication skills, including communicating technical risks, control deficiencies, and remediation recommendations to technical and non-technical stakeholders.
Strong attention to detail and ability to research, analyze, and evaluate information to support risk-based conclusions.
Ability to work independently, manage tasks autonomously, prioritize responsibilities, and achieve objectives.

Nice To Haves

Experience in the banking industry.
Bachelor’s degree in a relevant field of study.
Industry designation such as CISA, CISSP, or CRISC.

Responsibilities

Lead the Asset Class testing function within IT Risk.
Guide walkthroughs with infrastructure, security, and engineering teams to understand technology processes, challenge control design, and evaluate risk mitigation activities.
Design testing objectives and approaches, and independently test complex technology and infrastructure controls.
Assess the design and operating effectiveness of key technology controls, including compliance with enterprise policies, standards, regulatory requirements, and industry frameworks.
Provide technical guidance, mentorship, and subject matter expertise to members of the Technology, Security, and Data Risk Team.
Document test results to support informed, objective conclusions about risk exposure.
Draft testing observations about improvement opportunities or control deficiencies and recommend actions to technical and business stakeholders verbally and in writing.
Identify emerging technology risks and lead stakeholder discussions to determine whether risks should be added to the IT risk register.
Manage tasks and priorities independently and communicate technical risks and recommendations to technical and non-technical stakeholders.

Benefits

Base pay and pay-for-performance incentives based on personal and company goals.
Paid time off starting at 20 days, 11 paid holidays, and 8 hours of annual volunteer time off; amounts may vary by start date, employment status, and management level.
401(k) retirement savings plan with matching and company contributions.
Student loan pay-down and 529 educational savings assistance programs.
Tuition reimbursement.
Employee stock purchase plan.
Financial learning center and access to financial coaches.
Medical, dental, and vision insurance options.
Employee, spouse, and child life insurance.
Short- and long-term disability insurance.
Health Savings Account with employer contributions and Healthcare FSA.
Critical illness, accident, and hospital indemnity insurance.
Total well-being program.
Adoption, surrogacy, and fertility assistance.
Paid parental and caregiver leave.
Dependent Day Care FSA, backup child and adult/elder care days, and childcare discounts.
Employee assistance program.
Subsidized and discounted Weight Watchers program and other employee discount programs.
Depending on the role, eligibility for travel allowances, relocation assistance, signing bonus, and/or equity.