Technology Risk Analyst Lead

Flagstar Bank•New York, NY

3d•$90,597 - $150,440

About The Position

The Technology Risk Analyst Lead creates, maintains, assesses, and reports on information technology and information security threats, risks, and controls. The role identifies and documents potential gaps, tests and validates control adherence, and recommends and validates risk mitigation. It also conducts enterprise-wide cyber and technology risk assessments, prepares formal assessment reports, and communicates findings to senior leadership. The position governs and assesses technology and security programs, including policies, standards, controls, procedures, and testing requirements. It serves as a subject matter expert in the risk assessment framework, supports business and technology stakeholders in understanding risk and control responsibilities, and assists junior associates with complex technical concepts and best practices. The role requires independent judgment and problem-solving. Travel is less than 10%.

Requirements

Undergraduate degree (four years or equivalent); Computer Science or Cyber Security preferred.
At least 6 years of experience in Technology Audit, Information Technology, or Information Security.
At least 1 year of experience leading, coaching, and mentoring other technology professionals.
Strong understanding of internal and external processes and deadlines.
Expertise in technology and security risk mitigation.
Expertise in risk assessment and control development.
Experience designing risk and control programs aligned with FFIEC, NIST 800-53, NIST 800-37, and financial services regulatory requirements.
Knowledge of technology organization business processes and systems.
Experience creating and maintaining threat and risk registers and explaining residual risk to non-technical audiences.
Expertise in creating and maintaining KPIs and KRIs.
Prior experience implementing or overseeing cross-functional, enterprise-wide projects and technologies.
Well-rounded understanding of technology, operations, and key business processes.
Ability to build and maintain effective stakeholder relationships, communicate clearly, collaborate proactively, and deliver tailored solutions that address client needs.
Travel less than 10%.

Nice To Haves

Security+, CISA, CRISC, CISSP, or equivalent certification.
Computer Science or Cyber Security undergraduate degree.

Responsibilities

Govern and assess technology and security programs, including policies, standards, controls, procedures, and testing requirements, in alignment with NIST 800-53, NIST 800-37, the Secure Controls Framework, and industry best practices.
Design, validate, track, and report risk mitigation strategies in line with the company’s risk appetite, and communicate results to stakeholders, including executive leadership.
Conduct complex enterprise-wide risk assessments by mapping threats and controls, identifying gaps, and determining inherent and residual risk ratings in accordance with the enterprise Risk Governance Framework.
Create formal risk assessment reports and present them to executive leadership.
Serve as a subject matter expert in the risk assessment framework.
Help business-line and technology stakeholders understand risk and control requirements so that responsibilities are understood and followed across the enterprise.
Assist more junior associates with understanding complex technical concepts and best practices.
Use independent judgment and discretion to make decisions; analyze and resolve problems.
Perform special projects and additional duties and responsibilities as required.
Adhere to regulatory and compliance policies and standards, complete required compliance training, and maintain compliance with applicable federal, state, and local laws and regulations.
Build effective stakeholder relationships through clear communication, proactive collaboration, and cross-functional insights; foster a positive, productive work environment and support a strong customer and stakeholder experience.