Technology Risk Analyst Sr

Flagstar Bank•New York, NY

1d•$79,538 - $129,179

About The Position

The Senior Technology Risk Analyst creates, maintains, assesses, and reports on information technology and information security threats, risks, and controls. The role identifies and documents potential gaps, tests and validates control adherence, and recommends and validates risk mitigation. It also conducts enterprise-wide cyber and technology risk assessments, prepares formal assessment reports, and communicates findings to senior leadership. The analyst governs and assesses technology and security programs in alignment with NIST 800-53, NIST 800-37, the Secure Controls Framework, and industry best practices. The role supports stakeholders across business lines and technology in understanding risk and control responsibilities and assists junior associates with complex technical concepts and best practices. It requires independent judgment, problem-solving, and compliance with applicable laws, regulations, and company policies. Travel is less than 10%, and no unusual physical exertion is involved.

Requirements

High school diploma or equivalent (GED, HiSET, TASC, or foreign equivalent).
At least 4 years of experience in technology audit, information technology, or information security.
Security+, CISA, CRISC, CISSP, or equivalent certification.
Strong understanding of internal and external processes and deadlines.
Expertise in technology and security risk mitigation.
Expertise in risk assessment and control development.
Experience designing risk and control programs aligned with FFIEC, NIST 800-53, NIST 800-37, and financial services regulatory requirements.
Knowledge of technology organization business processes and systems.
Experience creating and maintaining threat and risk registers and explaining residual risk to non-technical audiences.
Expertise in creating and maintaining KPIs and KRIs.
Prior experience implementing or overseeing cross-functional, enterprise-wide projects and technologies.
Well-rounded understanding of technology, operations, and key business processes.
Ability to build and maintain effective stakeholder relationships through clear communication, proactive collaboration, and cross-functional insights.
Ability to build trusted internal or external client relationships by identifying needs and delivering tailored solutions.
Ability to foster or support a positive work culture and productive work environment.

Responsibilities

Govern and assess technology and security programs, including policies, standards, controls, procedures, and testing requirements, in line with NIST 800-53, NIST 800-37, the Secure Controls Framework, and industry best practices.
Design, validate, track, and report risk mitigation strategies in line with the company’s risk appetite, communicating results to stakeholders, including executive leadership.
Conduct complex enterprise-wide risk assessments, map threats and controls, identify gaps, and determine inherent and residual risk ratings in accordance with the enterprise Risk Governance Framework.
Create formal risk assessment reports and present findings to executive leadership.
Help business-line and technology stakeholders understand risk and control requirements and ensure responsibilities are understood and followed throughout the enterprise.
Assist more junior associates in understanding complex technical concepts and best practices.
Use independent judgment and discretion to make decisions.
Analyze and resolve problems.
Perform special projects and additional duties and responsibilities as required.
Adhere to regulatory and compliance policies and standards, complete required compliance training, and maintain compliance with applicable federal, state, and local laws and regulations.