Information Technology Enterprise Risk Manager

Jobtailor; Kentucky; On-site; USD 120,000 - 160,000; Full time

Job summary

Northwest is seeking an experienced risk professional to support execution and oversight of its Operational Risk framework for IT, information security and data risks. You will assess risks, validate controls, and drive remediation actions across first- and second-line teams.

Responsibilities include leading RCSA processes, challenging conclusions, monitoring risk metrics, and ensuring GLBA, PCI DSS, and HIPAA compliance.

Qualifications

• Bachelor's degree in MIS, cybersecurity, or business administration.
• 8–12 years of cybersecurity/IT experience.
• 6–8 years of financial institution experience.
• Deep understanding of IT, information security, and data principles.

Responsibilities

• Support execution and oversight of operational risk framework for IT, information security, and data risks.
• Oversee IT and data-related risk and control self-assessments (RCSA) and monitor routines.
• Validate first-line control testing and independently test IT, information security, and data controls.
• Mature second-line risk assessments and document controls; identify gaps and action plans.
• Assist with risk assessments including GLBA, authentication, PCI DSS, and HIPAA.

Skills

Cybersecurity/IT experience

Risk management

NIST CSF

GLBA/PCI DSS/HIPAA knowledge

Communication

Analytical skills

Problem solving

Education

Bachelor's Degree in MIS, Cybersecurity, or Business Administration

Tools

Vulnerability scanning tools

Penetration testing tools

Job description

• Support execution and oversight of Northwest's Operational Risk framework for information technology, information security, and data risks
• Oversee technology-related Risk and Control Self-Assessments (RCSA), challenge conclusions, and monitor routines
• Independently assess risks and drive actions addressing root causes of significant residual operational risk
• Validate first-line control testing and independently test IT, information security, and data controls
• Mature second-line technology and information security risk assessments, document controls, identify gaps, and create action plans
• Support key risk assessments, including GLBA, authentication and access, PCI DSS, and HIPAA assessments
• Consult on issues addressing control gaps and monitor remediation progress
• Establish and review metrics measuring technology risks and challenge deficient-metric action plans
• Oversee front-line IT, information security, and data activities and exception handling
• Challenge IT, information security, and data policies and standards for corporate governance compliance
• Analyze losses associated with IT failures, disruptions, and errors; identify root causes and recommend future risk avoidance
• Ensure compliance with company policies, procedures, and federal/state regulations
• Navigate Microsoft Office and department-specific applications
• Work as part of a team and with on-site equipment
• Perform additional duties assigned by management

Requirements

• Bachelor's Degree in Management Information Systems, Cybersecurity, or Business Administration
• 8–12 years of cybersecurity/information technology experience
• 6–8 years of prior financial institution experience
• Deep understanding of information technology, information security, and data principles and best practices
• Proficiency in risk management methodologies, frameworks, and RCSA execution
• Knowledge of NIST CSF, GLBA, PCI DSS, and HIPAA
• Experience with vulnerability scanning and penetration testing tools
• Strong analytical and problem-solving skills
• Excellent communication and reporting abilities
• Ability to comply with Northwest policies and procedures and federal/state regulations
• Ability to navigate Microsoft Office, computer applications, and department-specific software
• ITIL, CISA, CISM, CRISC, and CISSP certifications are listed

Core Competencies

Demonstrates expertise in managing operational risk frameworks, particularly in information technology and information security, while ensuring compliance with relevant regulations. Proficient in risk management methodologies and capable of conducting thorough risk assessments and control testing.

Certifications & Qualifications

• ITIL
• CISA
• CISM
• CRISC
• CISSP