Tech Risk and Controls Lead — Tech Resiliency Testing

JPMorganChase•Plano, TX

About The Position

The Tech Risk and Controls Lead within the Infrastructure Platforms (IP) team identifies and mitigates compliance and operational risks in line with firm standards. The role provides subject matter expertise and technical guidance to technology-aligned process owners, ensuring controls operate effectively and comply with regulatory, legal, and industry standards. It partners with Product Owners, Business Control Managers, regulators, and other stakeholders to report on technology risk posture and business impact. The role leads Technology Resiliency testing across the firm’s worldwide datacenter and cloud estate, owning the planning, execution, and closure of resiliency events. It represents IP in Technology Resiliency and partners with lines of business, Cybersecurity and Technology Controls, and Firmwide Business Resilience to improve the Resiliency Operating Framework in line with firmwide and regulatory obligations. AI-assisted work is central to the role. The lead uses authorized AI capabilities to automate manual work, accelerate documentation, analyze test and incident data, and improve team processes, while validating outputs and meeting data sensitivity, security, auditability, and regulatory expectations. The role requires flexibility to work weekends, on average once a month, because many resiliency events are scheduled outside business hours.

Requirements

At least 5 years of experience or equivalent expertise in technology risk management, cybersecurity, or a related field, focused on regulatory compliance and risk mitigation.
Experience using enterprise-authorized AI capabilities in technology risk and controls workflows, with strong validation habits and awareness of data sensitivity.
Ability to review and validate AI-assisted risk summaries and recommendations, escalate uncertainty, and ensure outcomes meet security, auditability, and regulatory expectations.
Strong overall technology background, including hands-on platform, infrastructure, or production support experience.
Experience planning and coordinating datacenter or cloud resilience, disaster recovery, or technology power-down events, with working fluency in failover and failback and concepts such as RTO, RPO, HA, and DR.
Hands-on experience with AWS products and services used for resilience, backup, replication, and multi-region recovery.
Practical, hands-on proficiency with LLM tools such as Claude and AI-assisted development environments such as VS Code, applied to improving day-to-day work.
Proficient knowledge of risk management and technology resiliency frameworks, control evaluation, design and governance, and risk assessment and reporting.
Program or project management discipline across scope, schedule, critical path, and deliverables, with success leading a team or function to metrics and quality targets; strong analytical and problem-solving skills.
Ability to influence executive-level decision-making and negotiate competing priorities, with executive presence and excellent verbal, written, and presentation skills.
BS/BA degree in a related technical or business discipline, or equivalent practical experience.

Nice To Haves

Financial services industry experience, knowledge of financial industry regulatory requirements for technology resiliency, and familiarity with Control Objectives and Procedures.
Experience in large, global, multicultural organizations supporting mission-critical, highly available applications, including third-party vendor management.
Track record of measurable efficiency gains through AI and automation, including prompt engineering, AI agents, or workflow orchestration, and ability to scale these practices across a team.
Modern engineering skills such as scripting or programming, data analytics, and cloud engineering (for example, Infrastructure-as-Code, CI/CD, or observability tooling), and a demonstrated desire for continued self-improvement.
Business continuity accreditation (for example, CBCP) and/or AWS certification (for example, Cloud Practitioner or Sys Ops Administrator).

Responsibilities

Own the end-to-end lifecycle of datacenter and cloud resiliency test events, including scoping against current compliance status, scheduling, preparing run-books, and managing change records and testing timetables.
Use enterprise-authorized AI capabilities to synthesize risk and control evidence and draft executive-ready reporting; validate outputs and handle data according to sensitivity and security requirements.
Lead live resiliency test execution for IP, run the command center, secure stakeholder participation, and keep business partners and senior management informed.
Identify, quantify, and communicate resiliency risk through post-test and post-incident analysis; evaluate recoveries, perform root cause analysis, and drive retests or corrective actions to closure.
Promote practical AI adoption across the team, using tools such as Claude and VS Code to automate work, produce run-books and documentation, and reduce touchpoints during failover and recovery events.
Promote reusable, AI-assisted approaches for recurring control testing and issue/action-plan management, with human review and alignment to auditability and regulatory expectations.
Apply AI to analyze test results, incident history, and compliance data, identify recurring failure modes and remediation priorities, embed reusable prompts and patterns, and coach colleagues in effective, responsible use.
Drive the resiliency roadmap across public and private cloud and cyber resiliency controls; use AWS services to design, test, and evidence multi-region, multi-availability-zone, and hybrid datacenter-to-cloud recovery.
Monitor resiliency control effectiveness against Firmwide Business Resilience standards, including Technology Recovery Action Plans (TRAP) for cyber and data-loss scenarios; identify gaps and recommend enhancements.
Execute reporting and governance for test compliance, controls, and issue management, providing senior management with regular insight into risks, exceptions, requests not to test, and escalations.
Develop and maintain relationships with application and product owners, LOB technologists, Cybersecurity and Technology Controls, and Firmwide Business Resilience partners to align on resiliency outcomes.