Principal Technology Risk Analyst - Program & Regulatory Assurance

Fidelity; Town of Texas (WI); On-site; USD 110,000 - 160,000; Full time

Job summary

Fidelity Investments is seeking a Principal Technology Risk Analyst to join the Program & Regulatory Assurance CoE. This role designs and maintains technology controls to meet program and regulatory requirements, collaborating with Controls Testing and risk teams across the enterprise.

Ideal candidates will have 5–7 years in IT risk or audit, a relevant bachelor’s degree, and professional certifications (CISSP, CISA, CRISC, CISM, CRE, CFE) with cloud security experience and strong communication

Qualifications

• 5–7 years’ experience in information technology risk, controls, or audit roles
• Bachelor’s degree in computer science, technology, or a related field of study preferred
• Professional technology and associated risk certifications (CISSP, CISA, CRISC, CISM), Certified risk/fraud examiners (CRE, CFE), and/or Cloud Certification(s) (CCSP, CCSK, AWS) preferred
• Experience documenting controls for large scale financial service organizations (cloud, distributed, vendor solutions, mainframe, network environments, and AI)
• Demonstrated technical abilities in multiple areas (technology infrastructure and application controls, cyber security, access management, network and cloud, resiliency, etc.)
• Working knowledge of Cloud security and controls and cloud technology environments (AWS/Azure, SaaS, PaaS)
• Strong knowledge of information technology processes and controls, and a comprehensive understanding of risk, quality control and assurance functions
• Knowledge of Industry standards, regulations, frameworks and best practices, such as NIST SP 800‑53, COBIT, AICPA Trust Principles, ISO27001, SWIFT, HITRUST, and SOX404 is preferred
• ISO9001 and/or ISO27001 certification preferred, with responsibility to support and participate in ISO peer audit reviews
• Knowledge of Governance, Risk, and Compliance (GRC) tools, such as Archer is preferred
• Excellent verbal and written communication skills enabling preparation and presentation of recommendations to senior management

Responsibilities

• Ensuring risk and control taxonomy aligns with enterprise standards
• Developing and monitoring technology controls for security and compliance
• Providing technical support and acting as liaison for technology risk management
• Managing control updates, annual mapping, and testing requirements
• Design, document, and maintain Risk and Control Matrices (RCMs/RACMs) across business and IT processes
• Continuously improve and standardize control documentation and governance practices
• Overseeing control certification process
• Partnering with Control Testing team to track progress and remediation
• Representing ETRA in enterprise control initiatives and special projects
• Supporting regulatory activities, risk assessments, and examinations
• Leading and supporting SOX 404 compliance, including control documentation
• Reviewing SOC reports, assessing CUECs, and communicating control gaps

Skills

IT risk

Controls documentation

Cloud security

Regulatory compliance

Stakeholder collaboration

SOX/compliance

Education

Bachelor's degree in computer science or related field

Tools

Archer

Job description

Principal Technology Risk Analyst – Program & Regulatory Assurance

Location

• Merrimack, NH
• Smithfield, RI
• Westlake, TX

Job Responsibilities

The Role

The Enterprise Technology Risk group is seeking a passionate, driven and experienced professional to contribute to the Technology Risk Program and Regulatory Assurance CoE team. This role is responsible for performing regulatory and program management responsibilities, including designing and maintaining technology controls to support program and regulatory requirements. This role will require networking and relationship management skills to collaborate with the Controls Testing team, and various business units and risk teams across the enterprise.

• Ensuring risk and control taxonomy aligns with enterprise standards
• Developing and monitoring technology controls for security and compliance
• Providing technical support and acting as liaison for technology risk management
• Managing control updates, annual mapping, and testing requirements
• Design, document, and maintain Risk and Control Matrices (RCMs/RACMs) across business and IT processes
• Continuously improve and standardize control documentation and governance practices
• Overseeing control certification process
• Partnering with Control Testing team to track progress and remediation
• Representing ETRA in enterprise control initiatives and special projects
• Supporting regulatory activities, risk assessments, and examinations
• Leading and supporting SOX 404 compliance, including control documentation
• Reviewing SOC reports, assessing CUECs, and communicating control gaps

The Team

The Technology Risk Program and Regulatory Assurance team is responsible for managing controls to support program requirements, monitoring the results of control testing to meet program requirements, and ensuring a consistent risk and control taxonomy is leveraged in accordance with enterprise best practices. The team supports regulatory activities such as maintaining application, server, and database inventories by entity. Technology Risk is part of the broader Legal, Risk and Compliance group and partners with Corporate Audit, Enterprise Compliance, and Security to protect the interests of our customers, employees, and our brand.

The Expertise and Skills You Bring

• 5‑7 years’ experience in information technology risk, controls, or audit roles
• Bachelor’s degree in computer science, technology, or a related field of study preferred
• Professional technology and associated risk certifications (CISSP, CISA, CRISC, CISM), Certified risk/fraud examiners (CRE, CFE), and/or Cloud Certification(s) (CCSP, CCSK, AWS) preferred
• Experience documenting controls for large scale financial service organizations (cloud, distributed, vendor solutions, mainframe, network environments, and AI)
• Demonstrated technical abilities in multiple areas (technology infrastructure and application controls, cyber security, access management, network and cloud, resiliency, etc.)
• Working knowledge of Cloud security and controls and cloud technology environments (AWS/Azure, SaaS, PaaS)
• Strong knowledge of information technology processes and controls, and a comprehensive understanding of risk, quality control and assurance functions
• A love of solving complex problems, comfort with ambiguous situations, and an ability to help solution innovative ways to mitigate risk using advanced analytical and critical thinking skills
• Ability to build and maintain collaborative working relationships with Information Technology and Business personnel to design effective controls
• Process orientation and understanding of operations and technology enabling support in the analysis, development, and monitoring of controls
• Knowledge of Industry standards, regulations, frameworks and best practices, such as NIST SP 800‑53, COBIT, AICPA Trust Principles, ISO27001, SWIFT, HITRUST, and SOX404 is preferred
• ISO9001 and/or ISO27001 certification preferred, with responsibility to support and participate in ISO peer audit reviews
• Knowledge of Governance, Risk, and Compliance (GRC) tools, such as Archer is preferred
• Excellent verbal and written communication skills enabling preparation and presentation of recommendations to senior management

Note: Fidelity will not provide immigration sponsorship for this position.

Onsite Working Model

Fidelity is transitioning to a full‑time onsite working model through a phased rollout across regions and roles. Currently, some roles and locations require 100% onsite presence, while others require less. Onsite expectations are likely to evolve as the rollout continues. This transition does not apply to fully remote roles.

Please be advised that Fidelity’s business is governed by the provisions of the Securities Exchange Act of 1934, the Investment Advisers Act of 1940, the Investment Company Act of 1940, ERISA, numerous state laws governing securities, investment and retirement‑related financial activities and the rules and regulations of numerous self‑regulatory organizations, including FINRA, among others. Those laws and regulations may restrict Fidelity from hiring and/or associating with individuals with certain criminal histories.

Equal Opportunity Employer

Fidelity Investments is an equal opportunity employer. We believe that the most effective way to attract, develop, and retain a diverse workforce is to build an enduring culture of inclusion and belonging.

Reasonable Accommodations

Fidelity will reasonably accommodate applicants with disabilities who need adjustments to participate in the application or interview process. To initiate a request for an accommodation contact the HR Accommodation Team by sending an email to [e-mail], or by calling 800‑835‑5099, prompt 2, option 3.

Applicant Screening

At Fidelity, we value honesty, integrity, and the safety of our associates and customers within a heavily regulated industry. Certain roles may require candidates to go through a preliminary credit check during the screening process. Candidates who are presented with a Fidelity offer will need to go through a background investigation and may be asked to provide additional documentation as requested. This investigation includes but is not limited to a criminal, civil litigations and regulatory review, employment, education, and credit review (role dependent). These investigations will account for 7 years or more of history, depending on the role. Where permitted by federal or state law, Fidelity will also conduct a pre‑employment drug screen, which will review for the following substances: Amphetamines, THC (marijuana), cocaine, opiates, phencyclidine.

AI Guidelines

Learn about our guidelines for use of AI when applying for a Fidelity job.