Tech Risk and Controls Lead

JPMorganChase • Jersey City, NJ

4d

About The Position

Join JPMorganChase's Cybersecurity Technology Controls team as a PCI Subject Matter Expert on the Global Regulatory Assessments team. The role leads end-to-end Payment Card Industry (PCI) assessments in support of the firm's Multi-Level PCI Compliance Validation efforts. It partners with external assessors, internal control owners, and business stakeholders to align assessments with PCI Data Security Standards (PCI DSS) frameworks and deliver quality outcomes within established timeframes.

This high-visibility position shapes the firm's security posture and compliance outcomes. The successful candidate bridges technical complexity and business needs, manages concurrent assessments, evaluates documentation and controls, supports remediation, and communicates risk findings and management reporting. The role also uses emerging technologies, including artificial intelligence and automation, to improve assessment efficiency, documentation quality, and risk identification.

Requirements

• Formal training or certification in assessments and exercises concepts, with 10 or more years of applied experience.
• Demonstrated expertise in technology risk and controls, risk-based consulting, risk assessments, audit, and regulatory activities, particularly PCI Data Security Standards.
• Comprehensive knowledge and practical experience across technology infrastructure and PCI DSS requirements, including implementation and oversight of technology risk and controls.
• Bachelor's degree in Computer Science, Management Information Systems, Accounting Information Systems, or a related field.
• Exceptional oral and written communication skills, including the ability to explain complex technical concepts to diverse audiences at all organizational levels and influence without direct authority.
• Experience in planning, coordination, and cross-functional execution, delivering quality outcomes across teams and functions.
• Strong attention to detail, analytical and decision-making skills, and capabilities in planning, time management, and prioritization.

Nice To Haves

• Experience in environments governed by compliance, regulatory, or risk-reduction controls, preferably in financial services.
• Proficiency in reviewing, understanding, and evaluating technical and software documentation to assess control suitability.
• Working knowledge of IT risk and process frameworks, including COSO, COBIT, NIST Cybersecurity Framework, and ITIL.
• Knowledge of process-focused methodologies for IT activities such as Change Management, Incident Management, and the Software Development Lifecycle (SDLC).
• Interest in and practical application of artificial intelligence, automation, and emerging technologies to improve compliance and assessment processes.
• Sound judgment in ambiguous situations, balancing regulatory requirements with business realities to develop pragmatic, risk-informed solutions.

Responsibilities

• Manage multiple concurrent PCI assessments in accordance with established methodology, frameworks, and firm standards, meeting time-sensitive deadlines through project management and stakeholder coordination.
• Capture, review, and analyze PCI-required documentation for quality and suitability against PCI Security Standards Council requirements, applying professional judgment to complex technical and compliance matters.
• Partner with business leads, control owners, and PCI team members to determine and validate assessment scope, including people, processes, and technologies.
• Collaborate with external Qualified Security Assessors (QSAs) to facilitate assessments and align them with business objectives and regulatory requirements.
• Monitor key risk parameters, identify non-compliance, and support remediation, including development of compensating controls for security, risk, and control gaps.
• Guide remediation activities and resolution of issues, action plans, and control breaks, and support closure verification.
• Develop and maintain relationships with business and technology stakeholders, serving as a trusted partner across stakeholder groups.
• Communicate risk and control findings, develop actionable recommendations, and provide accurate metrics and management reporting on time.
• Use artificial intelligence, automation, and other emerging technologies to enhance assessment efficiency, documentation quality, and risk identification.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior