Senior Lead Technology Risk Officer (Application Domain, SDLC, DevOps and AI)

Wells Fargo & Company•Irving, TX

About The Position

The Application Risk Domain Officer works within Technology Risk Management (TRM), part of Corporate Risk, providing independent second-line oversight across application domains. As a member of the Application Risk Domain Team, the officer evaluates domain-level conditions and develops evidence-based views of how application risks contribute to enterprise technology risk exposure. The role engages with Technology, including Tech Operations and CIO organizations, to provide challenge and inform risk-based decisions. Its outputs support senior management, risk committees, and regulators. The officer defines and advances domain-level risk assessment, monitoring, and reporting approaches; evaluates application-related risk conditions and the effectiveness of risk management practices and controls; and develops evidence-based assessments of enterprise technology risk. The role requires technical understanding of modern application engineering, including SDLC, CI/CD, infrastructure as code, cloud-native architectures, developer platforms, software supply chain processes, and AI-enabled engineering workflows. Candidates with experience operating, managing, or leading relevant technology capabilities are preferred. The successful candidate must engage engineering teams credibly, challenge complex technical matters, and translate technical observations into clear, decision-ready insights. This position provides expert second-line oversight of modern engineering practices and owns technology risk coverage across the application risk domain. It partners with first-line engineering, controls, and technology teams; assesses engineering environments and software delivery pipelines; leads technical risk reviews; evaluates AI-enabled engineering capabilities and application and platform controls; develops risk indicators and challenge metrics; and serves as a technical risk partner to engineering, security, architecture, and control teams. The position does not offer sponsorship. The posting end date is October 20, 2026, although the posting may be removed earlier due to applicant volume.

Requirements

At least 7 years of Technology Risk experience, or equivalent demonstrated through work experience, training, military experience, education, or a combination of these.
Proven technical depth across modern SDLC and DevSecOps, including source control, CI/CD, automated testing, deployment automation, production change controls, and software supply chain security.
Demonstrated ability to lead complex technical risk assessments, evaluate control effectiveness, identify systemic risk, and provide credible challenge across SDLC, DevSecOps, cloud, software supply chain, and AI-enabled engineering environments.
Ability to evaluate application architectures, deployment models, engineering evidence, technical standards, and control implementations, and to challenge complex technical decisions credibly.
Strong command of modern engineering platforms and security toolchains, including GitHub or GitLab, Jenkins or Azure DevOps, Terraform, containers, Kubernetes, cloud platforms, application security testing, and observability tools.
Experience implementing or assessing critical engineering controls across secure build and release processes, code provenance, secrets management, privileged automation, infrastructure as code, environment segregation, and runtime security.
Understanding of emerging AI engineering risks and controls, including AI coding assistants, automated code generation, agentic workflows, data exposure, traceability, and human oversight.
Exceptional judgment, executive communication, and influencing skills, including the ability to translate complex technical risks into business impact, actionable remediation, and decision-ready reporting.
The position does not offer sponsorship.

Nice To Haves

Progressive experience in software engineering, DevSecOps, platform or cloud engineering, application security, technology controls, or technology risk; front-line experience leading or operating technology capabilities is strongly preferred.
Knowledge of NIST, SSDF, COBIT, FFIEC guidance, or ISO 27001.
Financial services or regulated-industry experience.
Relevant security, risk, cloud, or software lifecycle certifications.

Responsibilities

Provide expert second-line oversight of application architecture patterns, secure SDLC, CI/CD, DevSecOps, platform engineering, infrastructure as code, containerized workloads, and production release controls.
Own second-line technology risk coverage and provide thought leadership across the application risk domain, partnering with first-line engineering, controls, and technology teams.
Assess application architecture, development practices, deployment pipelines, and supporting engineering controls.
Perform technically rigorous assessments of source control workflows, branching strategies, build systems, test automation, artifact repositories, package dependencies, deployment orchestration, and runtime platform configurations.
Evaluate software delivery pipeline integrity, including code provenance, trust boundaries, secrets handling, approval models, environment segregation, artifact immutability, and rollback or recovery capabilities.
Lead deep-dive technical risk reviews of complex delivery environments and modernization programs, translating observations into risk statements, root causes, and targeted remediation expectations.
Analyze developer ecosystems and engineering tool chains, including repositories, CI runners, build agents, package managers, IaC frameworks, containers, Kubernetes, cloud services, and observability stacks.
Evaluate AI-enabled engineering capabilities, including code assistants, prompt-based development, automated test generation, agentic tooling, and model-integrated developer platforms, with emphasis on data exposure, unsafe code generation, traceability, and human review.
Review application and platform control design and implementation, including policy-as-code, secrets management, service identity, environment hardening, logging, monitoring, drift detection, and release gating.
Develop risk indicators and challenge metrics for SDLC, DevSecOps, and AI-enabled engineering, including deployment control exceptions, pipeline bypasses, privileged access patterns, dependency exposure, control coverage gaps, and remediation aging.
Partner with engineering, security, architecture, and control teams to inform high-impact decisions and shape resilient engineering practices.
Translate complex technical risks into clear business impact, actionable remediation, and decision-ready reporting for senior management, risk committees, and regulatory stakeholders.