AVP IT Risk Management

Cathay Bank in; El Monte (CA); On-site; USD 85,000 - 103,000; Full time

Benefits offered by this job

Discretionary bonus

Full benefits package

Job summary

Cathay Bank is seeking a skilled IT risk and information security professional to oversee governance, risk management, and compliance across IT operations. This role ensures control testing, policy maintenance, and timely reporting to governance committees.

You will advise on control strengthening, develop remediation guidance, and collaborate with IT and business units to manage risk in a complex financial environment. Extensive IT risk experience is required.

Qualifications

• Bachelor’s degree in Computer Science, IT, or Information Security or equivalent.
• 3–5 years of IT risk, information security, or audit experience in financial services.
• Strong knowledge of IT governance, risk, and compliance frameworks.
• Experience with policy development and control testing.
• Ability to communicate risk to stakeholders across the organization.

Responsibilities

• Provide thought leadership and challenge to the first line of defense for control and risk matters.
• Oversee IT/IS risk management across Operations, Change/Configuration, and Information Security.
• Support IT/IS Risk Management program including policy creation, testing, and governance reporting.
• Document and report control failures and remediation guidance to stakeholders.
• Define ownership of controls in the GRC tool and schedule regular assessments.
• Promote adoption of the eGRC platform enterprise-wide.
• Provide guidance on IT/IS risk management and platform complexities.
• Develop periodic risk reports for IT and Information Security.

Skills

Strategic mindset

Regulatory knowledge

Communication skills

Project management

Excel / PowerPoint

Relationship building

Education

College degree in IT/InfoSec

Tools

GRC tool

eGRC platform

Job description

Are you enthusiastic, highly motivated, and have a strong work ethic? If yes, come join our team! At Cathay Bank – we strive to provide a caring culture that supports your aspirations and success. We believe people are our most valuable asset and we proudly foster growth and development empowering you to achieve your professional goals. We have thrived for 60 years and persevered through many economic cycles due to our team members' drive and optimism. Together we can make a difference in the financial future of our communities.

This position is responsible for the execution of 2LOD governance and oversight of Information Technology and Information Security Risk management which includes risks related to IT governance and strategy, IT Operations, Information Security, Change and Configuration Management, overall enterprise Information Technology governance, risk, and compliance (GRC) management including control testing, and regular reporting to the Bank's governance committees. The individual participates in the evaluation of Information Technology and Information Security controls for all material IT Projects or enterprise projects with significant technology dependencies. Individual will make recommendations and assist in the implementation of changes to work methods and procedures to make them more effective, to strengthen controls, or manage risk.

DIRECT REPORTS

This role has no direct reports.

ESSENTIAL FUNCTIONS

• As the second line of defense, provide thought leadership and constructive challenge to the first line of defense for control and risk-related matters.
• Oversee IT/IS risk management practices covering all facets of the IT and IS Risk Management Framework (including Operations, Change/Configuration Management, and Information Security), provide interpretation and counsel on policies and standards.
• Responsible for supporting the Information Technology & Information Security Risk Management program, including assisting with the creation, maintenance and retirement of IT and IS Risk Management policies and standards, performing control testing to evaluate design and operating effectiveness of controls, and assisting with compilation of testing results and reporting to governance committees.
• Documents and reports control failures and gaps to stakeholders. Provides remediation guidance and prepares management reports to track remediation activities.
• Defines and documents business process responsibilities and ownership of the controls in GRC tool. Schedules regular assessments and testing of operational effectiveness and efficiency of controls and creates GRC reports.
• Support the adoption of the Bank's eGRC platform throughout the enterprise and promote its use amongst the stakeholders of the Information Technology & Information Security Risk Management program.
• Provide technical and best practice guidance on Information Technology & Information Security Risk Management and Information Technology, accounting for specific business platform complexities, and issues.
• Provide input into the setting of enterprise risk appetite based on platform specific differences and specific business considerations.
• Develop periodic reports of Information Technology and Information Security Risks as required.
• Review Information Security, Information Technology, and cybersecurity control processes along with associated documentation, and reporting.
• Review key audit, regulatory and client due diligence to develop and communicate risk themes, and potential solutions to the business.
• Establish effective monitoring practices to ensure adherence to the IT & IS Risk Management framework, supporting policies and standards, and assist business in the identification of issues.
• Advise and collaborate with IT and the business on appropriate ways to strengthen controls in non-compliant areas.
• Advise and assess the mitigation of IT & IS Risk Management issues.
• Provide ongoing IT & IS Risk Management governance and direction for the enterprise.
• Engage with the Bank's leads for Information Technology, Information Security, Disaster Recovery & Business Continuity, Infrastructure, Third-Party Risk Management, Data Governance, and Change Management Practices to obtain technical domain advice and advise on matters of risk.
• Assist with the management of key risk assessment processes related to IT Risk (e.g., GLBA 501 (c), annual cyber risk and maturity assessment, etc.)
• Develop and maintain key business relationships to provide advice and oversight on new initiatives, products, and projects.

QUALIFICATIONS

Education: College degree in Computer Science, Information Technology, or Information Security or equivalent, CISA or similar audit certifications preferred

Experience: 3-5 years' experience in Information Security, IT Risk and/or Audit within the financial services industry.
Extensive knowledge and experience in Information Technology Governance, Risk, and Compliance.

Skills/Ability:

• Strategic mindset, with excellent knowledge and understanding of the financial industry.
• Highly developed ability for conceptual thinking.
• Excellent communication and presentation skills.
• Well-developed impact and influence skills.
• Proven track record of building strong relationships across business functions. Extensive knowledge and experience in regulatory guidance, most importantly for the FDIC, CFPB, and FFIEC requirements and supporting guidelines.
• Strong presentation skills, in anticipation of audiences with varying IT knowledge; ability to adjust presentation details based on audience.
• Demonstrated ability to interact effectively, internally and externally, with the most senior representatives of the Bank, other organizations, regulators, and vendors.
• Strong Microsoft Excel, PowerPoint, and report writing skills, including the ability to evaluate the usefulness of data and use it in meaningful communication.
• Proven ability to initiate and manage projects

OTHER DETAILS

Pay Grade: $85,000 to $103,000 / year

Pay determined based on job-related knowledge, skills, experience, and location.
This position may be eligible for a discretionary bonus.

Cathay Bank offers itsfull-time employees a competitive benefits package which is a significant part of their total compensation. It is our goal to provide employees with a comprehensive benefits package to fit their needs which includes, coverage for medical insurance, dental insurance, vision insurance, life insurance, long-term disability insurance, and flexible spending accounts (FSAs), health saving account (HSA) with company contributions, voluntary coverages, and 401(k).

Cathay Bank may collect personal information from potential job candidates and applicants. For more information on how we handle personal information and your applicable rights, please review our California Job Applicant Privacy Policy .

Cathay Bank is an Equal Opportunity and Aff…? We welcome applications for employment from all qualified candidates, regardless of race, color, ethnicity, ancestry, citizenship, gender, national origin, religion, age, sex (including pregnancy and related medical conditions, childbirth and breastfeeding), reproductive health decision-making, sexual orientation, gender identity and expression, genetic information or characteristics, disability or medical condition, military status or status as a protected veteran, or any other status protected by applicable law.

Cathay Bank endeavors to make www.CathayBank.com accessible to any and all users. If you would like to contact us regarding the accessibility of our website or need assistance completing the application process, please contact, Mickey Hsu, FVP, Employee Relations Manager, at [phone] or [e-mail] . This contact information is for accommodation requests only and cannot be used to inquire about the status of applications.