Senior Tech & Cybersecurity Risk & Controls Lead (Hybrid)

M&T Bank; Buffalo (NY); Hybrid; USD 124,000 - 206,000; Full time

Job summary

M&T Bank in Buffalo, NY, seeks a seasoned Controls Testing Leader to manage independent testing across Technology, Cybersecurity, and Data domains. You will influence risk outcomes by partnering with Risk Advisors and Risk Owners on risk identification, control coverage, and control design adequacy.

You will oversee annual testing planning, perform complex control assessments, and provide management reporting on testing results, remediation status, and risk trends.

Qualifications

• Bachelor's degree or higher with relevant work experience in technology/cybersecurity risk.
• Demonstrated expert knowledge of technology and/or cybersecurity risk principles.
• Minimum of 6 years' relevant work experience in or with the specific risk area.
• Experience with NIST 800-53/800-53a or similar control frameworks.
• Strong knowledge of cybersecurity principles and best practices.

Responsibilities

• Maintain testing methodology, procedures, and QA for consistent testing.
• Lead development and execution of Annual Controls Testing Plan.
• Direct and execute independent assessments of control design and operating effectiveness.
• Provide effective challenge on risk identification, control coverage, and test scope.
• Lead complex controls testing engagements involving high‑risk tech and cybersecurity processes.
• Evaluate remediation effectiveness and root causes of issues.

Skills

Risk principles

Cybersecurity knowledge

Project management

Regulatory awareness

Cross‑functional collaboration

Education

Bachelor's degree

Master's degree in IT/CS/Cybersecurity

Certifications: CISA/CAP/CISSP/CISM/CRISC

NIST/COBIT/ISO frameworks knowledge

Tools

Firewalls

DMZs

Encryption

Active Directory/LDAP

SAML

Job description

M&T Bank in Buffalo, NY, seeks a seasoned Controls Testing Leader to manage independent testing across Technology, Cybersecurity, and Data domains. You will influence risk outcomes by partnering with Risk Advisors and Risk Owners on risk identification, control coverage, and control design adequacy.

You will oversee annual testing planning, perform complex control assessments, and provide management reporting on testing results, remediation status, and risk trends.