IT Risk & Software Asset Management Lead (1LoD)

Natixis; New York (NY); Hybrid; USD 185,000 - 210,000; Full time

Job summary

Natixis seeks a Director of Technology Risk (LoD1) and SAM Lead to safeguard the CIB Americas IT landscape, ensuring compliance with complex regulatory requirements and risk governance. You will interface with LoD1.1, LoD2, CISO, and Compliance to manage IT risk, licensing, and controls across the region.

You will implement the Group IT Risk Management framework, tailor it to regional needs, and drive IT controls, SAM lifecycle, and MFA initiatives across the Americas.

Qualifications

• Minimum 10 years in Information Technology with hands-on IT risk management and SAM.
• Experience in highly regulated financial environments with FFIEC, Fed, and banking regulators.
• Bachelor’s degree; Master’s preferred.
• Certifications such as CRISC, CDPSE, CSAM or equivalents.
• Knowledge of NIST, ISO 27001, FFIEC risk frameworks and licensing models.

Responsibilities

• Drive IT risk strategy aligned with Head Office and regulatory expectations.
• Oversee Americas SAM program, governance, and licensing compliance.
• Lead risk assessments, vulnerability assessments, and audits with remediation plans.
• Prioritize systemic IT risks in critical systems and third‑party/vendor risk.
• Develop runbooks and procedures for IT risk management and SAM.

Skills

IT risk management

SAM (Software Asset Management)

Stakeholder engagement

Regulatory compliance

Leadership

Vendor management

Cloud/SaaS licensing

Education

Bachelor’s degree in IT/CS

Master’s degree preferred

Tools

ITAM platform

SAM tools

Job description

We are seeking a highly skilled, experienced, and strategic Director of Technology Risk (LoD1) and Software Asset Management (SAM) Lead to play a critical role in safeguarding the Natixis CIB Americas IT landscape and ensuring compliance with complex industry regulations.

In this executive-level role, you will serve as the primary interface for the Line of Defense 1.1 Group (comprising the Groupe BPCE and Natixis CIB Head Office in Paris) and Line of Defense 2 (including the CISO, Operational Risk, and Compliance teams) regarding IT risk taxonomies, framework alignment, and risk remediation. You will be vital to ensuring the robust security and compliance of Natixis CIB Americas IT, managing high-value software assets effectively, and mitigating risks associated with information technology operations.

The successful candidate will possess a deep understanding of IT risk frameworks, software licensing agreements, and industry best practices. You will lead the implementation of the Group IT Risk Management (ITRM) Framework, tailoring it to meet specific business and regional needs, while driving initiatives to assess, monitor, and enhance IT controls across the Americas platform.

Key Responsibilities

Leadership, Strategy, and Risk Governance

Drive IT Risk Strategy: Strengthen and execute the IT risk management strategy in strict alignment with Head Office (Groupe BPCE and Natixis CIB), organizational goals, and evolving regulatory expectations.

Lead Software Asset Management: Oversee the Americas SAM program, including process optimization, governance frameworks, and strategic contribution to the associated corporate policies managed at LoD2.

Conduct Comprehensive Assessments: Participate in, and periodically lead, risk assessments, vulnerability assessments, and audits to identify potential IT risks, propose robust mitigation plans, and recommend appropriate controls.

Prioritize Systemic Risks: Oversee and assist in the identification, analysis, and prioritization of risks associated with critical IT systems, proprietary software applications, and third-party vendors.

Process Optimization and Technical Execution

Establish Runbooks and Procedures: Develop, document, and maintain rigorous IT risk management procedures and associated operational runbooks in accordance with industry regulations and global bank standards.

Enforce SAM Lifecycle Management: Oversee the complete lifecycle of software assets from acquisition to retirement, ensuring compliance with complex licensing agreements, mitigating financial exposure, and optimizing usage in alignment with Head Office processes.

Perform System Integrity Checks: Conduct daily health and completeness checks for all software assets within the IT Asset Management (ITAM) platform.

Manage System Enhancements: Drive feature enhancements for the ITAM tool, collaborating closely with IT teams to prioritize, test, and implement functional improvements, particularly within the SAM space.

Collaboration, Reporting, and Compliance

Facilitate Asset Recertification: Coordinate the ITAM Annual Recertification process in partnership with IT asset owners to ensure the ongoing integrity, compliance, and accuracy of software inventories.

Partner with Key Stakeholders: Liaise with business, risk, and IT stakeholders to facilitate IT controls reviews, ensuring all regulatory and internal controls are met, documented, and reported.

Deliver Senior-Level Reporting: Prepare and present risk and control reports, including Data Risk Strategy (DRS) and operational risk reports, for executive and senior management.

Manage Risk Acceptances: Evaluate, document, and submit risk acceptances for the Chief Information Officer (CIO) Office, ensuring detailed justification for any temporary exceptions.

Enhance Operational Security: Coordinate the implementation and knowledge-transfer processes for Multi-Factor Authentication (MFA) across relevant applications to continuously strengthen the perimeter.

Remediate EOL Exposures: Perform random sampling and quality assurance on the End-of-Life (EOL) remediation tracking systems to ensure effective hazard mitigation.

Training, Culture, and Continuous Improvement

Foster an Accountability Culture: Develop and deliver targeted training programs to educate teams on IT risk management, regulatory expectations, and software licensing compliance, fostering a pervasive culture of risk awareness.

Monitor Emerging Trends: Stay at the forefront of industry trends, emerging technologies, regulatory shifts, and best practices in risk management and software licensing.

Required Qualifications

Education and Experience

Ideally, a Bachelor’s degree in Information Technology, Computer Science, Business Administration, or a related field (a Master’s degree or equivalent graduate degree is highly preferred).

A minimum of 10 years of comprehensive experience in Information Technology, featuring hands-on expertise in IT risk management and software asset management, complemented by progressive leadership or team-management experience.

Strong experience working within highly regulated financial environments, specifically with frameworks and compliance requirements mandated by the FFIEC, the Federal Reserve, and other key banking regulators.

Technical Skills and Certifications

Extensive knowledge of recognized IT risk frameworks (e.g., NIST, ISO 27001, and FFIEC) and complex software licensing models (including cloud, hybrid, and on-premises environments).

Active professional certifications such as Certified in Risk and Information Systems Control (CRISC), Certified Data Privacy Solutions Engineer (CDPSE), Certified Software Asset Manager (CSAM), or closely equivalent industry credentials.

Proven familiarity with cloud technologies, particularly Software as a Service (SaaS) models, subscription management, and associated financial optimization.

Familiarity with architecture governance and enterprise architecture frameworks.

Soft Skills and Leadership Attributes

Demonstrated ability to work independently, prioritize complex tasks under pressure, and consistently meet strict deadlines in a dynamic corporate setting.

Exceptional communication and interpersonal skills, with a proven track record of engaging, influencing, and collaborating with diverse stakeholders across regional offices and global headquarters.

Strong analytical, problem-solving, and decision-making capabilities, with a talent for translating complex technical risks into clear, actionable business strategies.

Solid experience in program management, vendor management, third-party governance, process improvement, and financial expense review.

The salary range for this position will be between $185,000 - $210,000. Natixis is required by law to include a reasonable estimate of the compensation range for this role. Actual base salary will vary and will be based on several factors including, but not limited to, relevant experience, education, skills set, applicable licensure and certifications, and other business and organizational needs. Base salary is only one component of our total rewards package. Natixis also offers a generous benefits package, and you may be eligible for a discretionary incentive award depending on company and individual performance.