Audit Director - Technology Enterprise Resilience

Citigroup, Inc.; Greater London; Hybrid; GBP 180,000 - 240,000; Full time

Benefits offered by this job

Generous holiday allowance plus bank

Discretional annual performance bonus

Private medical insurance

Employee Assistance Program

Pension Plan

Parental Leave

Exclusive employee discounts

Learning and development resources

Job summary

Citi London is seeking an Audit Director - Enterprise Resilience to lead the resilience audit program across Citi's global technology estate and services. The role aims to ensure resilience is embedded in IA's approach, with strong governance, cross-functional collaboration, and robust risk management across jurisdictions.

You will develop talent within the team, partner with technology, cyber, and business audit teams, and drive high-quality assurance while engaging with regulators and senior

Qualifications

• Experience leading resilience or related risk programs in a global financial institution or top-tier professional services firm.
• Strong knowledge of end-to-end resilience frameworks, mapping, impact tolerances and testing.
• Understanding of modern enterprise architecture, including cloud platforms and API ecosystems.
• Ability to influence senior stakeholders and communicate with Boards, management and regulators.

Responsibilities

• Develop and maintain the internal audit resilience assurance strategy aligned to regulatory expectations and evolving tech.
• Direct end-to-end delivery of the Enterprise Resilience audit portfolio with high quality and within budgets.
• Act as a trusted SME on Enterprise Resilience risks across the IA team.
• Partner with IA technology, cyber, third-party risk and business audit teams to scale resilience coverage.
• Evaluate critical business services mapping and impact tolerances substantiation.
• Assess severe-but-plausible scenario testing design and execution.
• Evaluate disaster recovery architecture, failover testing and restoration capabilities.
• Assess resilience of infrastructure, data centres, cloud, network and capacity management.
• Evaluate third-party and intragroup dependency management and exit planning.
• Assess incident and crisis management including detection, escalation, and post-incident learning.
• Lead resilience-related regulatory examinations and remediation programs.
• Champion horizon scanning for emerging resilience threats and methods.

Skills

Operational resilience

Technology risk

Disaster recovery

Cyber resilience

Third-party risk assurance

Cloud platforms (AWS, GCP, Azure)

End-to-end resilience frameworks

Executive presence

Global teams leadership

Regulatory examinations

Education

Bachelor's degree in computer science, engineering, or equivalent

CISA, CISSP, CSSP, CRISC, CBCI/MBCI certifications advantageous

Job description

Excited to grow your career?

Are you looking for a career move that will put you at the heart of a global financial institution? Then bring your skills and experience to Citi's Internal Audit Strategy, Innovation & Professional Practices team.

By joining Citi you will become part of a global organisation whose mission is to serve as a trusted partner to our clients by responsibly providing financial services that enable growth and economic progress.

Our people make all the difference in our success.

Team/Role Overview

The Audit Director - Enterprise Resilience is a senior level management position, reporting to the Chief Auditor - Technology, Strategy & Governance, Emerging Technologies and Resilience, responsible for managing a team of audit professionals with an overall objective to strategically direct audit activities and assessments of the risk and control environment for Citi's Enterprise Resilience. This covers the identification and mapping of critical and important business services, impact tolerance setting and testing, recovery and restoration capability, third-party and intragroup dependency management, and incident and crisis management.

This role will primarily focus on resilience across Citi's global businesses and technology estate, with the overall objective of ensuring that Citi Internal Audit's approach to resilience positions Citi IA as the leading IA function in the financial services industry.

Citi IA is a dynamic global function of over 2,500 professionals located across more than 60 countries, covering Citi's global businesses and service to clients and customers through its network in 98 countries. Through a culture of continuous improvement, Citi IA is focused on maintaining its position as a best-in-class IA function and is committed to investing in people, learning and development, innovation, and methodology programs. The Internal Audit mission is to provide independent, objective, reliable, valued and timely assurance to the Board, senior management and regulators of Citigroup and Citibank (and its subsidiaries), over the effectiveness of culture, ethical conduct, governance, risk management, and controls that mitigate current and evolving risks and to enhance the control environment. IA is a change agent within Citi to enhance the control culture of Citigroup worldwide and therefore support senior management decision making around the globe.

Citi operates in over 100 countries and provides consumers, corporations, governments, and institutions with a broad range of financial services and products. Citi strives to create the best outcomes for clients and customers with financial ingenuity that leads to solutions that are simple, creative, and responsive.

What you will do

• Develop and maintain the Internal Audit resilience assurance strategy, ensuring coverage remains aligned to regulatory expectations, emerging risks and the firm's evolving technology landscape.
• Direct and oversee the end-to-end delivery of the Enterprise Resilience audit portfolio, ensuring all audits, thematic reviews, and continuous monitoring activities are executed with high quality, within approved budgets, and in compliance with IA methodology and professional standards.
• Act as a trusted subject matter expert on Enterprise Resilience risks and controls in financial services across the IA team.
• Partner with IA technology, cyber, third-party risk and business audit teams to scale resilience assurance across IA work programs and avoid duplicative coverage.
• Evaluate the identification of critical and important business services, the completeness and accuracy of end-to-end service mapping, and the substantiation of impact tolerances.
• Assess the design and execution of severe-but-plausible scenario testing, including the credibility of assumptions, the realism of test conditions, and the treatment of results that breach tolerance.
• Evaluate recovery and restoration capability, including disaster recovery architecture, failover and switchback testing, backup integrity, data recovery, and the ability to restore within stated tolerances.
• Assess the resilience of underlying infrastructure, including data centres, cloud platforms, network, capacity management and single points of failure, alongside concentration in providers and locations.
• Evaluate third-party and intragroup dependency management, covering criticality assessment, contractual protections, subcontracting and fourth-party visibility, exit planning and stressed exit, and substitutability.
• Assess incident and crisis management, including detection, escalation, invocation, command structures, regulatory notification, and post-incident learning.
• Evaluate the adequacy and effectiveness of internal resilience governance policies, adherence to applicable resilience laws and regulations across jurisdictions, and the robustness of self-identification and self-assessment processes.
• Lead Internal Audit engagement on resilience-related regulatory examinations, thematic reviews, supervisory interactions and significant remediation programmes, providing independent challenge and assurance to senior management and regulators.
• Champion horizon scanning for emerging resilience threats and for emerging methods and approaches in resilience risk management.
• Develop and retain talent in the resilience team, growing both their technical and risk management capabilities.
• Support and endorse the Quality Assurance (QA) function of IA, and resolve issues found by QA, improving audit processes and coverage
• Develop and maintain strong working relationships across other IA teams and relevant stakeholders.

What we will need from you

Qualifications

• Strong track record leading operational resilience, technology risk, disaster recovery, cyber resilience, or third-party risk assurance programs within a global, systemically important financial institution (G-SIFI) or top-tier professional services firm.
• Strong knowledge of end-to-end resilience frameworks (IBS identification, end-to-end mapping, impact tolerances, severe-but-plausible scenario testing, and resilience metrics).
• Comprehensive understanding of modern enterprise architecture, including cloud platforms (AWS, GCP, Azure), microservices, API ecosystems, distributed databases, active-active topologies, and zero-trust security.
• Strong executive presence with a demonstrated ability to influence senior stakeholders, challenge constructively, manage complex global issues and communicate effectively with Boards, senior management and regulators.
• Proven track record of building, leading and developing high-performing global teams, including talent management, succession planning and technical capability development.
• Demonstrated success leading large-scale audit, risk or assurance portfolios across complex, globally distributed organizations.
• Consistently demonstrates sound judgement, independence, integrity and the ability to remain objective in a highly regulated environment.
• Strong understanding of global resilience regulations, notably UK PRA/FCA Operational Resilience regulations (SS1/21, PS21/3), EU Digital Operational Resilience Act (DORA), US Interagency Guidance on Third-Party Risk & Operational Resilience, MAS TRM/ORM guidelines, and CPMI-IOSCO resilience principles.
• Proven experience leading regulatory examinations, remediation validation, and MRA/MRIA closure engagements.

Education

• Bachelor's degree/University degree in computer science, engineering, or equivalent.
• Professional certifications such as CISA, CISSP, CSSP, CRISC, or CBCI/MBCI are advantageous.

What we can offer you

We work hard to have a positive financial and social impact on the communities we serve. In turn, we put our employees first and provide the best-in-class benefits they need to be well, live well and save well.

By joining Citi London, you will not only be part of a business casual workplace with a hybrid working model (up to 2 days working at home per week), but also receive a competitive base salary (annually reviewed), and enjoy a whole host of additional benefits such as:

• Generous holiday allowance starting at 27 days plus bank holidays; increasing with tenure.
• A discretional annual performance related bonus
• Private medical insurance packages to suit your personal circumstances.
• Employee Assistance Program
• Pension Plan
• Paid Parental Leave
• Exclusive discounts for employees, family, and friends
• Access to an array of learning and development resources

Alongside these benefits Citi is committed to ensuring our workplace is where everyone feels comfortable coming to work as their whole self every day. We want the best talent around the world to be energised to join us, motivated to stay, and empowered to thrive.

#LI-MP4

Job Family Group:

Internal Audit

Job Family:

Audit

Time Type:

Full time

Most Relevant Skills

Controls Assessment, Data Analysis, Industry Knowledge, Issue Management, Laws and Regulations, Risk Management Lifecycle, Root Cause Analysis.

Other Relevant Skills

For complementary skills, please see above and/or contact the recruiter.

Citi is an equal opportunity employer, and qualified candidates will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other characteristic protected by law.

If you are a person with a disability and need a reasonable accommodation to use our search tools and/or apply for a career opportunity review Accessibility at Citi.

View Citi's EEO Policy Statement and the Know Your Rights poster.