Technology Risk and Controls Manager - Senior Associate

JPMorgan Chase & Co.; Greater London; On-site; GBP 90,000 - 120,000; Full time

Job summary

J.P. Morgan is seeking a Technology Risk and Controls Senior Associate to lead Security Configuration Management across cloud, data center, and endpoint environments.

You will partner with engineering and risk teams to drive governance, standards, and measurable control objectives in a fast-paced, high-security culture. The role blends deep technical risk expertise with governance rigor, leveraging AI-enabled capabilities for risk analysis, evidence synthesis, and executive reporting, while

Qualifications

• Experience leading technology risk and cybersecurity controls in LOB context.
• Strong knowledge of AWS security controls and services.
• Ability to translate policy into implementable, testable controls.
• Proven track record in control testing, remediation, and executive reporting.
• Excellent stakeholder management across product, engineering, and risk teams.

Responsibilities

• LOB cyber risk leadership: primary risk contact for the LOB Applications and governance routines.
• Develop and tailor technical control objectives for Security Configuration Management across domains.
• Leverage AI capabilities to accelerate risk analysis and documentation; ensure data sensitivity compliance.
• Define measurable control performance metrics and integrate telemetry into governance dashboards.
• Draft executive-ready risk/control reports with auditability and traceability.
• Lead issue management and action-plans with evidence of remediation progress.
• Partner with engineering to assess control sufficiency against threat models and policies.
• Govern hybrid security posture across AWS, data centers, and endpoints.
• Guide integration of configuration drift/security tooling with GRC ecosystem.
• Provide strategic risk posture insights to technology leadership.

Skills

LOB-aligned technology risk

AWS security controls

translate policy into controls

control testing & remediation

stakeholder management

Education

CISM/CRISC/CISSP

Job description

Technology Risk and Controls Manager - Senior Associate

Description

We know that people want great value combined with an excellent experience from a bank they can trust, so we launched our digital bank, Chase International, to revolutionize mobile banking with seamless journeys that our customers love. We're already trusted by millions in the US and we're quickly catching up in the UK - but how we do things here is a little different. We're building the bank of the future from scratch, channelling our start-up mentality every step of the way - meaning you'll have the opportunity to make a real impact.

Join us and help protect what matters most. As part of our security team, you'll grow your skills, collaborate with talented colleagues, and make a real impact on our technology risk management efforts. We offer a supportive environment where you can develop your career and contribute to a culture of innovation and security. Be part of a team that values your curiosity and commitment to excellence.

Job Summary

As a Tech Risk and Controls Senior Associate at International Consumer Banking within the Cybersecurity Technology and Controls, you will be responsible for the LOB risk assessment, governance, standardization, and measurement across all the Cyber domains. Your primary focus will be leading and managing the Security Configuration Management domain. This role ensures that foundational and advanced controls across platform, network, endpoint and application security configuration are governed by clearly defined standards and measurable control objectives. This position blends deep technical understanding of controls and tooling with architectural oversight and governance rigor ensuring that the firm's operational controls are consistently engineered, validated, and improved especially across cloud-native environments.

While we're looking for professional skills, culture is just as important to us. We understand that everyone's unique - and that diversity of thought, experience and background is what makes a good team, great. By bringing people with different points of view together, we can represent everyone and truly reflect the communities we serve.

Job Responsibilities

• LOB cyber risk leadership: Act as the primary cybersecurity and technology risk point-of-contact for the LOB Applications, shaping priorities, escalation paths, and governance routines across the application/platform portfolio.
• Control objectives & standards (AWS / configuration security): Lead the development, tailoring, and adoption of technical control objectives and standards for Security Configuration Management and other cyber domains (identity, logging/monitoring, vulnerability management, network security), ensuring applicability to LOB architectures and delivery models.
• Risk identification & decision support (with approved AI): Leverage enterprise-authorized AI capabilities to accelerate architecture risk analysis, threat/risk identification, and documentation; validate outputs and handle data per sensitivity and security requirements.
• Control performance & effectiveness metrics: Define measurable control performance and effectiveness metrics per control category; integrate telemetry, automation signals, and operational KPIs into LOB governance dashboards to provide clear, outcome-based visibility.
• Evidence, reporting, and audit readiness (with approved AI): Use enterprise-authorized AI capabilities to accelerate synthesis of risk/control evidence and draft executive-ready reporting; ensure human review, traceability, and auditability of conclusions.
• Issue and action-plan leadership: Drive reuse-first, AI-assisted routines for recurring control testing, deficiency management, and action-plan execution; ensure closure evidence meets internal audit and regulatory expectations.
• Partnering and challenge function (within LOB): Partner with engineering and operations to evaluate control sufficiency against threat models, regulatory expectations, and internal policies; provide credible challenge and pragmatic remediation options.
• Hybrid control governance: Govern control implementation and sustainment across AWS cloud, data center, and endpoint ecosystems used by the LOB, ensuring consistent security posture and minimizing control drift.
• Tooling integration into GRC: Assess and guide integration of configuration drift and security tooling (e.g., Evolven, Puppet, Chef, Wiz or equivalents) with the firm's GRC ecosystem to support standardized control objectives, testing, and evidence capture.
• Strategic insights for LOB leadership: Provide clear posture assessments, trend analysis, and forward looking risk insights to LOB technology leadership and risk governance forums; drive continuous improvement in control efficiency and effectiveness.

Required Qualifications, Capabilities, and Skills

• Experience in LOB-aligned technology risk and/or cybersecurity control leadership, including influencing delivery teams and driving execution through governance and remediation.
• Strong working knowledge of AWS security controls and services (e.g., IAM, Organizations/SCPs, CloudTrail, Config, GuardDuty, Security Hub, KMS, VPC) and how they support auditable control outcomes.
• Demonstrated ability to translate policy/standards into implementable, testable controls; define evidence requirements; and communicate risk clearly to both engineers and executives.
• Proven experience managing control testing cycles, issue remediation, and executive reporting in an audit- and regulatory-facing environment.
• Strong stakeholder management across product, engineering, operations, architecture, and risk partners; ability to lead through influence.

Preferred Qualifications, Capabilities, and Skills

• CISM, CRISC, CISSP, or similar industry-recognized risk certifications

ABOUT US

J.P. Morgan is a global leader in financial services, providing strategic advice and products to the world's most prominent corporations, governments, wealthy individuals and institutional investors. Our first-class business in a first-class way approach to serving clients drives everything we do. We strive to build trusted, long-term partnerships to help our clients achieve their business objectives.

We recognize that our people are our strength and the diverse talents they bring to our global workforce are directly linked to our success. We are an equal opportunity employer and place a high value on diversity and inclusion at our company. We do not discriminate on the basis of any protected attribute, including race, religion, color, national origin, gender, sexual orientation, gender identity, gender expression, age, marital or veteran status, pregnancy or disability, or any other basis protected under applicable law. We also make reasonable accommodations for applicants' and employees' religious practices and beliefs, as well as mental health or physical disability needs. Visit our FAQs for more information about requesting an accommodation.

ABOUT THE TEAM

Our professionals in our Corporate Functions cover a diverse range of areas from finance and risk to human resources and marketing. Our corporate teams are an essential part of our company, ensuring that we're setting our businesses, clients, customers and employees up for success.