Senior Associate, Operational Risk Management, IT and Security

The OCC • Chicago, IL

11d • $98,100 - $142,050 • Hybrid

About The Position

The Senior Associate provides critical support to the Director of Operational Risk by evaluating IT and Security risks, assisting with risk assessments, and applying the risk management framework across the process, risk, and control universe. The role supports risk assessment program activities, coordinates with IT, Security, TPRM, Legal, Compliance, and Internal Audit, and facilitates Corporate Risk governance aligned with OCC strategy and short-term objectives.

The position leads OCC’s IT and Security risk identification and assessment work, maintains supporting risk inventories and taxonomies, and communicates assessment results to governance committees, business owners, leadership, and regulators. It also helps enhance Corporate Risk methodologies and program materials, supports automation of IT and Security oversight using data analytics, and tracks internal findings, external examination issues, and business-area issues arising from the Enterprise Risk Assessment. The role has no supervisory responsibilities.

Requirements

• Advanced understanding of IT and Security risk, particularly cybersecurity (including blue team, red team, and threat and vulnerability management), disaster recovery, database management, network engineering, storage management, software development, and mainframe technologies.
• Intermediate understanding of operational risk.
• Familiarity with the evolving cybersecurity landscape affecting central clearing counterparties (CCPs).
• Ability to act as a trusted advisor and provide effective challenge.
• Creative, independent thinker willing to develop and drive new ideas.
• Excellent written, verbal, and presentation skills.
• Team-oriented and able to collaborate effectively within and across departments.
• Ability to work under pressure and meet tight deadlines.
• Proficiency in Microsoft Word, Excel, Access, and PowerPoint.
• Experience with eGRC systems such as Archer.
• Experience with data analytics techniques and tools such as Tableau and SQL.
• Bachelor’s degree in Information Systems, Computer Science, Cybersecurity, or equivalent is listed as required, with the posting also describing it as preferred.
• At least 3 years of experience in enterprise risk, cybersecurity, IT audit, technology risk, security risk, or risk consultancy, specifically focused on assessing IT and Security risk.

Nice To Haves

• Familiarity with Financial Market Utilities and securities and derivatives markets.
• Ability to work in a highly regulated environment, including with the SEC, CFTC, and Federal Reserve; familiarity with Covered Clearing Agency regulations.
• Understanding of cloud technologies, including experience supporting migration to a cloud platform.
• Understanding of tools supporting capacity management, network architecture, threat assessment, code review, and software development.
• Consulting experience.
• Certification such as CISSP, Security+, CSX-P, CET, CISA, or CISM.

Responsibilities

• Collaborate with IT, Security, TPRM, Legal, Compliance, and Internal Audit to strengthen the effective management of IT and Security risk across the organization.
• Lead OCC’s IT and Security risk identification and assessment process and verify the consistency and reliability of related technology frameworks and systems supporting clearing and settlement activities.
• Drive adherence to methodologies, guidance, and standards for risk identification and assessment frameworks.
• Maintain risk inventories, taxonomies, and other elements supporting IT and Security risk management and compliance activities.
• Lead and execute IT and Security risk assessments aligned with the risk and control universe and regulatory requirements and expectations.
• Generate reports from Archer data for stakeholders, including regulators.
• Help automate IT and Security risk oversight using data analytics processes.
• Communicate risk assessment results to governance committees, business owners, and leadership at various levels.
• Collaborate on the enhancement and maintenance of Corporate Risk program methodologies, policies, procedures, and job aides, including development of new program activities.
• Track and update ORMC team internal findings, external examination issues, and business-area self-identified issues resulting from Enterprise Risk Assessment.

Benefits

• Hybrid work environment with up to 2 days per week of remote work.
• Tuition reimbursement.
• Student loan repayment assistance.
• Technology stipend for connecting to the network while working remotely.
• Generous paid time off and parental leave.
• 401(k) employer match.
• Competitive medical, dental, and vision benefits.
• Potential discretionary annual incentive compensation award; target incentive range is 8% to 15%, and awards are not guaranteed.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level