Technology Risk and Controls [Multiple Positions Available]

JPMorganChase•Chicago, IL

1d•Onsite

About The Position

This role involves providing guidance in creating risk-focused metrics across technology domains for managing interactive and App2App privileged accounts, internal and third-party system access, cloud data encryption services, and technology asset lifecycle management. The position requires conducting reviews of cyber and technology metrics, ensuring proper scoping, sourcing in-scope technology asset data, calculation logic, and threshold setting to maintain effectiveness. Analysis of metric data and breach patterns is crucial for calibrating thresholds to ensure effective technology risk management. The role also includes generating reports with breach commentary for technology control forums, developing and maintaining management guidance for metrics, and enhancing the service capability of the Metrics Program by streamlining operational procedures. Collaboration with risk pillars, process owners, risk & control managers, product partners, and the second line of defense is expected to implement a data-driven approach for cyber & technology control compliance and risk management. The position supports the enhancement of technology risk and controls management, aligning with strategic objectives, cybersecurity principles, and industry standards. This position requires up to 10% domestic travel.

Requirements

Bachelor's degree in Engineering (Any), Computer Science, Information Security, or related field of study plus 7 years of experience in the job offered or as Technology Risk and Controls Lead, Project Manager, Process Consultant, Corporate Quality, or related occupation.
Master's degree in Engineering (Any), Computer Science, Information Security, or related field of study plus 5 years of experience in the job offered or as Technology Risk and Controls Lead, Project Manager, Process Consultant, Corporate Quality, or related occupation.
Five (5) years of experience with governing technology risk, identifying, managing and reporting risks, overseeing risk remediation, and treatment of non-compliance issues in technology risk and information security management.
One (1) year of experience with identifying and evaluating technology and cyber risks, including change implementation and operation failures.
One (1) year of experience with defining risk and control metrics and developing frameworks aligned with industry standards.
One (1) year of experience with creating strategic plans for GT Metrics and designing KPI & KRI risk metrics, including scoping and data sourcing.
One (1) year of experience with analyzing data flow diagrams and assessing ingestion tools for data flow capabilities.
One (1) year of experience with governing metric development, ensuring lifecycle adherence, and calibrating thresholds according to risk appetite.
One (1) year of experience with monitoring metric performance, escalating breaches, and reporting to control forums.
One (1) year of experience with driving GT Metrics process automation.
One (1) year of experience with analyzing the impact of changes on technology processes for response strategies.

Responsibilities

Provide guidance in creating risk-focused metrics across technology domains for managing interactive and App2App privileged accounts, internal and third-party system access, cloud data encryption services, and technology asset lifecycle management.
Conduct reviews of cyber and technology metrics, ensuring proper scoping, sourcing in-scope technology asset data, calculation logic, and threshold setting to maintain effectiveness.
Analyze metric data and breach patterns, facilitating the calibration of thresholds to ensure effective technology risk management.
Generate reports with breach commentary for technology control forums, providing insights into risk profile across cybersecurity and technology controls landscape.
Develop and maintain management guidance for metrics, ensuring alignment with the Organization's Operational Risk Metrics Policy and promoting adherence among metric owners and stakeholders.
Enhance service capability of the Metrics Program by streamlining operational procedures and operationalizing processes for metrics owners, driving improvements in the operational efficiency of metrics governance processes.
Work with risk pillars, process owners, risk & control managers from lines of business, product partners and second line of defense to implement data-driven approach for cyber & technology control compliance and risk management.
Support the enhancement of technology risk and controls management, aligning with strategic objectives, cybersecurity principles and industry standards.