Technology Risk and Controls Manager - Senior Associate

JPMorgan Chase & Co.; City of Westminster; In loco; GBP 90.000 - 130.000; Tempo pieno

Descrizione del lavoro

JPMorgan Chase & Co. is seeking a Tech Risk and Controls Senior Associate to lead Security Configuration Management across cloud and on‑premises environments.

The role requires governance, risk identification, and measurable control objectives with a strong emphasis on cloud security and tooling integration. The candidate will partner with engineering and risk teams to ensure auditable control outcomes, use enterprise AI judiciously, and deliver executive-ready reporting.

Competenze

• Demonstrated experience in technology risk and cybersecurity governance.
• Ability to translate policy into implementable, testable controls.
• Proven experience managing control testing cycles, issue remediation, and executive reporting.

Mansioni

• Act as the primary cybersecurity and technology risk partner for the LOB Applications, shaping priorities and governance routines across the portfolio.
• Lead the development and adoption of technical control objectives for Security Configuration Management and other cyber domains.
• Leverage AI capabilities to accelerate risk analysis and documentation while ensuring auditability and human review.

Conoscenze

AWS security controls

Governance & risk management

Security configuration management

AI-assisted risk analysis

Stakeholder management

Formazione

CISM, CRISC, CISSP or equivalent certifications

Strumenti

Evolven

Puppet

Chef

Wiz

Descrizione del lavoro

As a Tech Risk and Controls Senior Associate at International Consumer Banking within the Cybersecurity Technology and Controls, you will be responsible for the LOB risk assessment, governance, standardization, and measurement across all the Cyber domains. Your primary focus will be leading and managing the Security Configuration Management domain. This role ensures that foundational and advanced controls across platform, network, endpoint and application security configuration are governed by clearly defined standards and measurable control objectives. This position blends deep technical understanding of controls and tooling with architectural oversight and governance rigor ensuring that the firm's operational controls are consistently engineered, validated, and improved especially across cloud-native environments. While we're looking for professional skills, culture is just as important to us. We understand that everyone's unique - and that diversity of thought, experience and background is what makes a good team, great. By bringing people with different points of view together, we can represent everyone and truly reflect the communities we serve.,

• LOB cyber risk leadership: Act as the primary cybersecurity and technology risk point-of-contact for the LOB Applications, shaping priorities, escalation paths, and governance routines across the application/platform portfolio.
• Control objectives & standards (AWS / configuration security): Lead the development, tailoring, and adoption of technical control objectives and standards for Security Configuration Management and other cyber domains (identity, logging/monitoring, vulnerability management, network security), ensuring applicability to LOB architectures and delivery models.
• Risk identification & decision support (with approved AI): Leverage enterprise-authorized AI capabilities to accelerate architecture risk analysis, threat/risk identification, and documentation; validate outputs and handle data per sensitivity and security requirements.
• Control performance & effectiveness metrics: Define measurable control performance and effectiveness metrics per control category; integrate telemetry, automation signals, and operational KPIs into LOB governance dashboards to provide clear, outcome-based visibility.
• Evidence, reporting, and audit readiness (with approved AI): Use enterprise-authorized AI capabilities to accelerate synthesis of risk/control evidence and draft executive-ready reporting; ensure human review, traceability, and auditability of conclusions.
• Issue and action-plan leadership: Drive reuse-first, AI-assisted routines for recurring control testing, deficiency management, and action-plan execution; ensure closure evidence meets internal audit and regulatory expectations.
• Partnering and challenge function (within LOB): Partner with engineering and operations to evaluate control sufficiency against threat models, regulatory expectations, and internal policies; provide credible challenge and pragmatic remediation options.
• Hybrid control governance: Govern control implementation and sustainment across AWS cloud, data center, and endpoint ecosystems used by the LOB, ensuring consistent security posture and minimizing control drift.
• Tooling integration into GRC: Assess and guide integration of configuration drift and security tooling (e.g., Evolven, Puppet, Chef, Wiz or equivalents) with the firm's GRC ecosystem to support standardized control objectives, testing, and evidence capture.
• Strategic insights for LOB leadership: Provide clear posture assessments, trend analysis, and forward-looking risk insights to LOB technology leadership and risk governance forums; drive continuous improvement in control efficiency and effectiveness.
  Experience in LOB-aligned technology risk and/or cybersecurity control leadership, including influencing delivery teams and driving execution through governance and remediation.
• Strong working knowledge of AWS security controls and services (e.g., IAM, Organizations/SCPs, CloudTrail, Config, GuardDuty, Security Hub, KMS, VPC) and how they support auditable control outcomes.
• Demonstrated ability to translate policy/standards into implementable, testable controls; define evidence requirements; and communicate risk clearly to both engineers and executives.
• Proven experience managing control testing cycles, issue remediation, and executive reporting in an audit- and regulatory-facing environment.
• Strong stakeholder management across product, engineering, operations, architecture, and risk partners; ability to lead through influence., CISM, CRISC, CISSP, or similar industry-recognized risk certifications
  We know that people want great value combined with an excellent experience from a bank they can trust, so we launched our digital bank, Chase International, to revolutionize mobile banking with seamless journeys that our customers love. We're already trusted by millions in the US and we're quickly catching up in the UK - but how we do things here is a little different. We're building the bank of the future from scratch, channelling our start-up mentality every step of the way - meaning you'll have the opportunity to make a real impact.
• Join us and help protect what matters most. As part of our security team, you'll grow your skills, collaborate with talented colleagues, and make a real impact on our technology risk management efforts. We offer a supportive environment where you can develop your career and contribute to a culture of innovation and security. Be part of a team that values your curiosity and commitment to excellence., J.P. Morgan is a global leader in financial services, providing strategic advice and products to the world's most prominent corporations, governments, wealthy individuals and institutional investors. Our first-class business in a first-class way approach to serving clients drives everything we do. We strive to build trusted, long-term partnerships to help our clients achieve their business objectives., Our professionals in our Corporate Functions cover a diverse range of areas from finance and risk to human resources and marketing. Our corporate teams are an essential part of our company, ensuring that we're setting our businesses, clients, customers and employees up for success.