Privacy Risk & Controls Lead - GLBA/PCI

Fifth Third Bank; Cincinnati (OH); On-site; USD 90,000 - 130,000; Full time

Job summary

Fifth Third Bank is seeking a Business Controls professional specializing in privacy risk and compliance. The role focuses on GLBA and PCI DSS risk assessment activities, coordinating ROC efforts, and collaborating with Legal, Compliance, IT, Audit, and Enterprise Risk to strengthen privacy controls.

The position involves planning and executing internal PCI assessments, guiding business partners on regulatory requirements, and integrating privacy risk information into the ERM framework for

Qualifications

• Experience leading GLBA risk assessments for financial services.
• Coordination of PCI ROC activities across lines of business.
• Ability to assess privacy and data protection risks and suggest remediation.

Responsibilities

• Lead and coordinate GLBA Risk Assessments for applicable lines of business.
• Support PCI ROC activities, coordinate assessment evidence and control validation.
• Plan and execute internal PCI assessments to ensure PCI DSS compliance.
• Provide SME guidance on GLBA, PCI and privacy requirements to stakeholders.
• Partner with leadership to implement controls and sustainable privacy processes.
• Identify privacy and data protection risks in business processes and recommend improvements.
• Monitor evolving privacy laws and PCI standards and advise on applicability.
• Support change management related to privacy and information protection.

Skills

GLBA knowledge

PCI DSS knowledge

Risk assessment

Controls testing

Regulatory guidance

Job description

Fifth Third Bank is seeking a Business Controls professional specializing in privacy risk and compliance. The role focuses on GLBA and PCI DSS risk assessment activities, coordinating ROC efforts, and collaborating with Legal, Compliance, IT, Audit, and Enterprise Risk to strengthen privacy controls.

The position involves planning and executing internal PCI assessments, guiding business partners on regulatory requirements, and integrating privacy risk information into the ERM framework for