Business Controls Senior Associate - Privacy GLBA/PCI

Fifth Third Bank; Cincinnati (OH); On-site; USD 90,000 - 130,000; Full time

Job summary

Fifth Third Bank is seeking a Business Controls professional specializing in privacy risk and compliance. The role focuses on GLBA and PCI DSS risk assessment activities, coordinating ROC efforts, and collaborating with Legal, Compliance, IT, Audit, and Enterprise Risk to strengthen privacy controls.

The position involves planning and executing internal PCI assessments, guiding business partners on regulatory requirements, and integrating privacy risk information into the ERM framework for

Qualifications

• Experience leading GLBA risk assessments for financial services.
• Coordination of PCI ROC activities across lines of business.
• Ability to assess privacy and data protection risks and suggest remediation.

Responsibilities

• Lead and coordinate GLBA Risk Assessments for applicable lines of business.
• Support PCI ROC activities, coordinate assessment evidence and control validation.
• Plan and execute internal PCI assessments to ensure PCI DSS compliance.
• Provide SME guidance on GLBA, PCI and privacy requirements to stakeholders.
• Partner with leadership to implement controls and sustainable privacy processes.
• Identify privacy and data protection risks in business processes and recommend improvements.
• Monitor evolving privacy laws and PCI standards and advise on applicability.
• Support change management related to privacy and information protection.

Skills

GLBA knowledge

PCI DSS knowledge

Risk assessment

Controls testing

Regulatory guidance

Job description

Make banking a Fifth Third better

We connect great people to great opportunities. Are you ready to take the next step? Discover a career in banking at Fifth Third Bank.

Business Controls - Privacy Risk & Compliance

GENERAL FUNCTION

As a first line of defense, provides specialized Business Controls support focused on identifying, assessing, mitigating, monitoring, and managing privacy, information protection, and regulatory risks, with particular emphasis on the Gramm-Leach-Bliley Act (GLBA) and Payment Card Industry Data Security Standard (PCI DSS).

Responsible for coordinating and conducting GLBA Risk Assessments, supporting PCI Report on Compliance (ROC) efforts across applicable lines of business, and planning and executing internal PCI assessments. Partners with lines of business to evaluate privacy and data protection risks, assess the design and effectiveness of controls, identify gaps, and support the development and implementation of appropriate remediation.

Serves as a subject matter expert for GLBA, PCI, and related privacy risk and control requirements, providing guidance to business partners and working closely with Legal, Compliance, Enterprise Risk, Information Security, Technology, Audit, and other key stakeholders. Monitors changes in applicable laws, regulations, standards, and regulatory guidance and assists the business in understanding and incorporating those requirements into business processes and controls.

Supports Business Controls in advancing privacy risk management practices, processes, assessments, reporting, and tools within the organization's Enterprise Risk Management (ERM) framework. Develops and presents meaningful risk information and insights to stakeholders to support informed decision-making and effective management of privacy and data protection risks.

Responsible and accountable for risk by openly exchanging ideas and opinions, elevating privacy, security, and control concerns, and following established policies and procedures. Operates within the Bank's and lines of business' established risk appetites while consistently identifying, assessing, managing, monitoring, and reporting privacy, data protection, and related operational risks.

ESSENTIAL DUTIES AND RESPONSIBILITIES

• Leads and coordinates GLBA Risk Assessments for applicable lines of business, including identification and evaluation of privacy and information protection risks, controls, potential gaps, and remediation needs.
• Supports the organization's PCI Report on Compliance (ROC) activities across applicable lines of business, including coordination of assessment activities, evidence collection, control validation, documentation, and engagement with business stakeholders and the external Qualified Security Assessor (QSA).
• Plans, coordinates, and executes internal PCI assessments to evaluate compliance with applicable PCI DSS requirements and the effectiveness of associated business processes and controls.
• Serves as a Business Controls subject matter expert for GLBA, PCI, and related privacy and data protection requirements, providing guidance and interpretation to lines of business and other stakeholders.
• Partners with business leadership to develop and implement controls, policies, procedures, and sustainable processes designed to effectively manage privacy, GLBA, PCI, and data protection risks.
• Provides expertise and analysis related to the identification, assessment, control, monitoring, testing, and reporting of privacy and information protection risks.
• Evaluates business processes involving the collection, use, storage, transmission, sharing, retention, and protection of sensitive information to identify potential privacy, GLBA, and PCI-related risks and control gaps.
• Maintains awareness of evolving privacy laws, GLBA requirements, PCI DSS standards, regulatory guidance, and industry practices, and assists in evaluating their applicability and potential impact to business processes and controls.
• Supports regulatory change management activities related to privacy, GLBA, PCI, and information protection requirements to help ensure applicable changes are identified, assessed, communicated, and incorporated into business practices.
• Identifies control breakdowns, inadequate processes, and unexpected events involving privacy or protected information and partners with Business Controls leadership and lines of business to develop appropriate corrective actions.
• Supports the resolution of privacy, GLBA, PCI, information-security, Audit, Compliance, and Risk Management issues, including identification of root causes and development and monitoring of remediation activities.
• Partners with lines of business to establish appropriate business ownership of privacy-related processes, risks, controls, assessments, testing, and remediation activities.
• Builds effective relationships with Legal, Compliance, Enterprise Risk, Information Security, Technology, Audit, other Business Controls organizations, and li