Technology Risk and Controls Manager – Senior Associate

JPMorgan Chase & Co.; Greater London; On-site; GBP 90,000 - 130,000; Full time

Job summary

JPMorgan Chase & Co. in the United Kingdom seeks a Technology Risk and Controls Manager – Senior Associate to lead risk assessment, governance, and measurement across Cyber domains.

You will steer the Security Configuration Management program, ensuring clearly defined standards and measurable objectives across cloud, data center, and endpoint security. You will combine deep technical risk insight with governance rigor, driving improvements, partnering with engineering and operations, and

Qualifications

• Experience leading technology risk and cybersecurity controls within an LOB
• Deep knowledge of AWS security controls and services
• Ability to translate policy into implementable, testable controls
• Proven experience managing control testing cycles, issue remediation, and executive reporting
• Strong stakeholder management across product, engineering, operations, architecture, and risk partners

Responsibilities

• LOB cyber risk leadership: act as primary cybersecurity and technology risk point-of-contact for the LOB Applications, shaping priorities and governance routines across the portfolio
• Control objectives & standards (AWS / configuration security): lead development and adoption of technical control objectives and standards for Security Configuration Management
• Risk identification & decision support (with approved AI): leverage AI to accelerate architecture risk analysis and documentation
• Control performance & effectiveness metrics: define measurable metrics and dashboards for governance
• Evidence, reporting, and audit readiness (with AI): use AI to accelerate synthesis of evidence and draft executive reports
• Issue and action-plan leadership: drive AI-assisted routines for testing, remediation, and action plans with audit expectations
• Partnering and challenge function (within LOB): collaborate with engineering and operations for remediation options
• Hybrid control governance: govern controls across AWS cloud, data center and endpoint ecosystems
• Tooling integration into GRC: guide integration of configuration drift and security tooling with GRC ecosystem
• Strategic insights for LOB leadership: provide posture assessments and trend analyses

Skills

LOB risk leadership

AWS security controls

Policy to controls

Control testing & remediation

Stakeholder management

Tools

Evolven

Puppet

Chef

Wiz

Job description

Technology Risk and Controls Manager – Senior Associate

Description

We know that people want great value combined with an excellent experience from a bank they can trust, so we launched our digital bank, Chase International, to revolutionize mobile banking with seamless journeys that our customers love. We’re already trusted by millions in the US and we’re quickly catching up in the UK – but how we do things here is a little different. We’re building the bank of the future from scratch, channelling our start-up mentality every step of the way – meaning you’ll have the opportunity to make a real impact.

Join us and help protect what matters most. As part of our security team, you’ll grow your skills, collaborate with talented colleagues, and make a real impact on our technology risk management efforts. We offer a supportive environment where you can develop your career and contribute to a culture of innovation and security. Be part of a team that values your curiosity and commitment to excellence.

Job Summary:

As aTech Risk and Controls Senior Associateat International Consumer Banking within the Cybersecurity Technology and Controls, you will be responsible forthe LOB risk assessment, governance, standardization, and measurement across all the Cyber domains. Your primary focus will be leading and managing the Security Configuration Management domain. This role ensures that foundational and advanced controls across platform, network, endpoint and application security configuration are governed by clearly defined standards and measurable control objectives. This position blends deep technical understanding of controls and tooling with architectural oversight and governance rigor ensuring that the firm’s operational controls are consistently engineered, validated, and improved especially across cloud‑native environments.

While we’re looking for professional skills, culture is just as important to us. We understand that everyone's unique – and that diversity of thought, experience and background is what makes a good team, great. By bringing people with different points of view together, we can represent everyone and truly reflect the communities we serve.

Job Responsibilities:

• LOB cyber risk leadership:Act as the primary cybersecurity and technology risk point-of-contact for the LOB Applications, shaping priorities, escalation paths, and governance routines across the application/platform portfolio.
• Control objectives & standards (AWS / configuration security):Lead the development, tailoring, and adoption of technical control objectives and standards for Security Configuration Management and other cyber domains (identity, logging/monitoring, vulnerability management, network security), ensuring applicability to LOB architectures and delivery models.
• Risk identification & decision support (with approved AI):Leverage enterprise-authorized AI capabilities to accelerate architecture risk analysis, threat/risk identification, and documentation; validate outputs and handle data per sensitivity and security requirements.
• Control performance & effectiveness metrics:Define measurable control performance and effectiveness metrics per control category; integrate telemetry, automation signals, and operational KPIs into LOB governance dashboards to provide clear, outcome-based visibility.
• Evidence, reporting, and audit readiness (with approved AI):Use enterprise-authorized AI capabilities to accelerate synthesis of risk/control evidence and draft executive-ready reporting; ensure human review, traceability, and auditability of conclusions.
• Issue and action-plan leadership:Drive reuse-first, AI-assisted routines for recurring control testing, deficiency management, and action-plan execution; ensure closure evidence meets internal audit and regulatory expectations.
• Partnering and challenge function (within LOB):Partner with engineering and operations to evaluate control sufficiency against threat models, regulatory expectations, and internal policies; provide credible challenge and pragmatic remediation options.
• Hybrid control governance:Govern control implementation and sustainment across AWS cloud, data center, and endpoint ecosystems used by the LOB, ensuring consistent security posture and minimizing control drift.
• Tooling integration into GRC:Assess and guide integration of configuration drift and security tooling (e.g., Evolven, Puppet, Chef, Wiz or equivalents) with the firm’s GRC ecosystem to support standardized control objectives, testing, and evidence capture.
• Strategic insights for LOB leadership:Provide clear posture assessments, trend analysis, and forward-looking risk insights to LOB technology leadership and risk governance forums; drive continuous improvement in control efficiency and effectiveness.

Required Qualifications, Capabilities, and Skills:

• Experience inLOB-aligned technology risk and/or cybersecurity control leadership, including influencing delivery teams and driving execution through governance and remediation.
• Strong working knowledge ofAWS security controls and services(e.g., IAM, Organizations/SCPs, CloudTrail, Config, GuardDuty, Security Hub, KMS, VPC) and how they support auditable control outcomes.
• Demonstrated ability to translate policy/standards intoimplementable, testable controls; define evidence requirements; and communicate risk clearly to both engineers and executives.
• Proven experience managingcontrol testing cycles, issue remediation, and executive reportingin an audit- and regulatory-facing environment.
• Strong stakeholder management across product, engineering, operations, architecture, and risk partners; ability to lead through influence.

Preferred Qualifications, Capabilities, and Skills:

• CISM, CRISC, CISSP, or similar industry-recognized risk certifications