Risk & Compliance Project Manager and Application Manager

Citigroup; Mississauga; Hybrid; CAD 90,000 - 150,000; Full time

Job summary

Citigroup in Canada seeks a Risk & Compliance Project Manager and Application Manager to oversee critical GRC/RegTech and audit platforms, ensuring security, reliability, and regulatory alignment.

The role bridges business risk units, compliance officers, IT, and auditors, coordinating large-scale regulatory initiatives with a hybrid work model. Strong governance and cross-functional leadership are essential.

Qualifications

• 6-8+ years in IT application management, technology project management and governance within regulated environments.
• Experience managing enterprise GRC/RegTech platforms (e.g., ServiceNow IRM/GRC, Archer, MetricStream, OneTrust, Actimize).
• Proven track record delivering regulatory technology projects and handling audit findings.
• Strong knowledge of regulatory standards and control frameworks (SOX, GDPR, DORA, etc.).
• Proficiency in Agile, Waterfall and ITIL Service Management.
• Ability to translate mandates into architecture requirements and roadmaps.

Responsibilities

• Own the lifecycle, stability, and evolution of GRC/RegTech and audit platforms.
• Oversee availability, DR planning, and observability for risk data pipelines and reporting engines.
• Govern change control, releases, and auditability with minimal downtime.
• Lead incident management, RCA, and remediation of controls.
• Enforce RBAC, SoD, and data protection across managed systems.
• Interface with audit teams, regulators, and third-party risk assessors.
• Lead end-to-end regulatory tech and compliance integration initiatives.

Skills

IT application mgmt

Technology project mgmt

RegTech platforms

Risk and compliance governance

Tools

ServiceNow IRM/GRC

Archer

MetricStream

OneTrust

Actimize

Job description

Role Overview

The Risk & Compliance Project Manager and Application Manager is a dual-mandate leadership role designed to oversee the end-to-end lifecycle, stability, and evolution of critical enterprise risk, regulatory, and compliance software applications, while concurrently driving large-scale regulatory and compliance technology initiatives. This hybrid position bridges business risk units, compliance officers, information security teams, internal/external auditors, and core IT engineering groups. The incumbent ensures that business-critical compliance applications operate reliably, securely, and in full alignment with evolving domestic and global regulatory standards (e.g., SOX, GDPR, GLBA, DORA, Basel/FRTB, AML/KYC), while managing multi-stream technical projects from inception through delivery.

Key Responsibilities

• Part A: Application Management & Operational Governance
  • Lifecycle & Operational Ownership: Own the operational health, support frameworks, SLA adherence, and ongoing lifecycle of GRC (Governance, Risk, and Compliance), RegTech, and audit platforms.
  • Application Availability & Resiliency: Oversee system performance, disaster recovery planning, business continuity (BCP/DR), and observability for mission-critical risk data pipelines and reporting engines.
  • Release & Change Management: Govern change control boards (CCB) and application release schedules, ensuring all configuration changes, patches, and version upgrades maintain strict auditability and minimal operational downtime.
  • Incident & Problem Management: Act as technical escalation lead for high-severity incidents, orchestrating rapid resolution, root-cause analysis (RCA), and preventative control remediation.
  • Access Governance & Data Protection: Enforce least-privilege role-based access control (RBAC), segregation of duties (SoD), and sensitive data encryption across all managed compliance systems.
• Part B: Risk, Compliance & Regulatory Assurance
  • Regulatory Interpretation & Alignment: Translate new regulatory mandates, industry frameworks, and supervisory guidance into actionable application architecture requirements and project roadmaps.
  • Audit & Exam Management: Serve as the primary technical interface for internal audit teams, external regulatory bodies, and third-party risk assessors; ensure timely delivery of evidentiary artifacts and control testing data.
  • Issue Tracking & Remediation (CAPs/MRAs): Manage the identification, tracking, and technical remediation of audit findings, corrective action plans (CAPs), Matters Requiring Attention (MRAs), and vulnerability assessments.
  • Continuous Control Monitoring: Design and maintain automated key risk indicators (KRIs) and key control indicators (KCIs) embedded within application workflows.
• Part C: Project & Program Management
  • End-to-End Project Delivery: Lead complex regulatory technology and compliance integration initiatives from scoping, business case formulation, and milestone tracking to deployment and operational handover.
  • Methodology & Governance: Apply Agile, Waterfall, or hybrid project management methodologies to coordinate cross-functional sprints, release gates, and steering committee cadences.
  • Scope, Budget & Resource Management: Manage project schedules, resource allocations, dependency risks, and financial budgets (CapEx/OpEx).
  • Executive Reporting & Stakeholder Alignment: Deliver comprehensive project scorecards, risk burndown charts, and executive status dashboards to Chief Risk Officers (CRO), Chief Compliance Officers (CCO), and IT leadership.
• Part D: Vendor & Third-Party Risk Management
  • Vendor Oversight: Oversee relationships with GRC/RegTech software vendors and implementation partners, monitoring performance against contractual SLAs and statements of work (SOWs).
  • Third-Party Risk Assessment (TPRM): Conduct ongoing third-party technology risk assessments, SOC report reviews, and security posture evaluations for vendor-hosted applications.

Required Qualifications & Experience

• Professional Experience
  • 6-8+ years of progressive experience spanning IT application management, technology project management, and technology risk/compliance governance within regulated environments (e.g., Financial Services, Banking, Healthcare, or FinTech).
  • Proven track record of managing enterprise GRC/RegTech platforms (e.g., ServiceNow IRM/GRC, Archer, MetricStream, OneTrust, Actimize, or proprietary risk calculation engines).
  • Demonstrated experience delivering high-stakes regulatory technology projects, managing regulatory examinations, and resolving audit findings.
• Technical & Domain Competencies
  • Regulatory Frameworks: Strong working knowledge of major regulatory standards and control frameworks (e.g., NIST CSF, ISO 27001, SOX 404, SOC 1/2, GDPR, DORA, FFIEC, PCI-DSS).
  • Project & Service Methodologies: Proficiency in Agile (Scrum/Kanban), Waterfall, and ITIL Service Management frameworks (Change, Incident, Problem, Release).
  • Technology Stack Awareness: Solid understanding of enterprise soft