Sr Associate, Cloud Risk Management
Banco Santander Brazil - Boston, MA
posted 13 days ago
About the position
The Senior Associate, Cloud Risk Management is responsible for the strategic development, implementation, and effective execution of the Operational Risk (OR) program, the key program elements of which cover: internal loss, external loss, risk assessment, business impact assessments, KRIs, scenario analysis / stress testing, training, awareness, and communication, issues and remediation planning, tracking, MIS and reporting, testing, compliance, and monitoring. Monitors activities to minimize the company's exposure to technology and information risk associated with the adoption and deployment of cloud technologies. Activities may include technical risk analysis, risk identification and remediation. Represents or supports the reputation of the company to minimize compliance and regulatory risk by resolving issues and ensuring adherence to regulatory requirements, industry good practice frameworks and company and legal standards. Responsible for ensuring that all of the company's activities adhere to the necessary rules and regulations, and that the company complies with legal/regulatory statutes and jurisdictions. The Senior Associate, Cloud Risk Management within the Technology and Information Risk Management organization reports to the Director - Emerging Technology Risk and is responsible for ongoing oversight, assessment, management and reporting of technology and cybersecurity risks associated with the adoption and implementation of Cloud, across all operating entities. This role is established in the second line of defense and requires collaboration across IT, CISO, Data Office, Operational Risk, Internal Audit and other relevant functional stakeholders within the organization in the management of Emerging Technology risks. An excellent understanding of the evolving regulatory landscape in the US and EU are vital for success in this role. The day-to-day focus may vary depending on the requirements of the overall second line of defense program priorities directed by the Head of Technology Risk and may include: planned or ad-hoc technical risk reviews, technical review of cloud security architectures, review and challenge activities of IT or Business initiatives, Risk reporting, development as well as review and challenge of technical risk framework and methodologies.
Responsibilities
- Establish themselves as the second line of defense subject matter expert on Cloud technology and security risk management
- Identify and assess technology and cybersecurity risks associated with the adoption and deployment of Cloud, on risk management issues to ensure awareness and accountability for emerging technology risks
- Participate in the independent and ongoing risk oversight of key technology components of the firm's digital transformation initiatives
- Participate in evaluation of new products / Business changes / projects and assess related emerging technology risks and impact to the technology risk profile
- Participate in the evaluation and management of risks related to third-party suppliers involved in technology projects related to the deployment of emerging technology or where emerging technologies introduced by third parties are a key component of the business activities
- Perform review and challenge of first line of defense risk management processes, data and outcomes (e.g. risk assessments, control evaluations, risk metrics, mitigation plans, risk acceptances etc.) and communicate risk opinions at various levels of management
- Analyze risk data from various sources (e.g. external events, control deficiencies, risk register etc.) to identify and measure levels of risk, concentration, trends and patterns
- Support process for constructive engagement across the Lines of Defense regarding differences or conflicts in risk appetite, risk metric determination or evaluation, issue severity or other areas of dispute
- Advise on remediation of regulatory findings, correction of any inconsistencies and monitor resolution
- Prepare information to enable governance committees / working groups in the management oversight of Cloud risks
- Initiate timely escalations to the Technology Risk leadership team
- Work across the lines of defense to recommend strategies that effectively treat risks within the risk appetite
Requirements
- Bachelor's Degree in a technical discipline or equivalent work experience: Computer Science, Information Technology, Information Systems, Information Security
- Professional Certifications in Cloud Security
- Practitioner experience in Cloud Security Risks with expertise in securing cloud environments (AWS preferred) and understanding cloud service models (IaaS, PaaS, SaaS)
- In-depth knowledge of cloud computing platforms such as AWS (Preferred) / IBM / GCP / Azure
- Cloud Networking standards and best practices
- Overall professional experience of 5+ years or more in Cloud architect or risk management roles in a matrix organization
- Experience within a highly regulated environment such as the financial services industry
- Experience performing Cloud assurance activities
Nice-to-haves
- Master's Degree in related technical disciplines
- Professional Certifications in one or more Emerging technology areas
Benefits
- 401k
- health_insurance
- dental_insurance
- vision_insurance
- life_insurance
- disability_insurance
- paid_holidays
- tuition_reimbursement
- professional_development
