Hybrid Senior IT/Cyber Risk Testing Lead

Ally Bank; Detroit (MI); Hybrid; USD 85,000 - 150,000; Full time

Job summary

Ally Bank in Detroit is seeking an IT/Cyber Risk Senior Analyst to join the Technology, Security, and Data Risk Team. You will lead testing of complex technology and infrastructure controls, planning and executing risk-based testing while collaborating with stakeholders to assess risk exposure.

The role requires IT Audit, IT Risk Management, or Information Security experience and the ability to evaluate control design and operating effectiveness.

Qualifications

• 3+ years in IT Audit, IT Risk, Information Security, or control testing.
• Banking industry experience preferred.
• Knowledge of FFIEC guidance and frameworks (NIST, COBIT, ISO 2700x, PCI-DSS).
• Strong written and verbal communication; able to convey risk to technical and non-technical stakeholders.

Responsibilities

• Lead Asset Class testing within IT Risk and guide walkthroughs with teams.
• Design testing objectives and independently perform testing of complex tech controls.
• Assess design and operating effectiveness of key technology controls.
• Provide mentorship and guidance to other team members in the IT Risk group.
• Document test results and support risk conclusions for stakeholders.
• Draft observations and recommendations to improve controls and risk posture.
• Identify emerging tech risks and raise them to the IT risk register.

Skills

IT Audit

IT Risk

Information Security

Regulatory Compliance

Communication

Education

Bachelor's degree in relevant field

Professional certification (CISA/CISSP/CRISC)

Tools

NIST

COBIT

ISO 2700x

PCI-DSS

Job description

Ally Bank in Detroit is seeking an IT/Cyber Risk Senior Analyst to join the Technology, Security, and Data Risk Team. You will lead testing of complex technology and infrastructure controls, planning and executing risk-based testing while collaborating with stakeholders to assess risk exposure.

The role requires IT Audit, IT Risk Management, or Information Security experience and the ability to evaluate control design and operating effectiveness.