IT Risk & Compliance Manager (For independent contractor)

The IT Risk & Compliance Manager is an individual contributor role within the Trust, Risk, Assurance and Compliance portfolio. The role is focused on leading the identification of enterprise risks including, but not limited to: cybersecurity, privacy and regulatory compliance risks. This role requires engaging with senior stakeholders to identify appropriate risk responses, and supporting and maintaining a fit-for-purpose IT controls framework, including the development of additional IT controls. The IT Risk & Compliance Manager is also a subject matter expert leveraging a deep understanding of the enterprise risk discipline combining deep knowledge of theory and organizational practice or expertise across several different disciplines within a function.

This individual convinces stakeholders who may be skeptical or unwilling to accept new concepts, practices and approaches when it comes to enterprise risk. Successful risk expertise requires dynamic individuals who are able to liaise with various senior stakeholders and thus need to be articulate communicators, foster collaboration, integrate perspectives and drive to business beneficial outcomes.

Key Responsibilities

• Support stakeholders with cybersecurity or regulatory compliance related risk expertise and knowledge. Responsible for identifying technology risks and proposing control design. Provide advice on control design that is both sustainable and right sized (i.e. a simple solution for a simple problem, no overengineering).

  
  

• Drive business engagement in the Tech business function to provide risk and compliance awareness for teams that have a clear need to manage risks without significantly affecting their development velocity and/or play a key role towards achieving strategic objectives in the company.

  
  

• Support senior stakeholders across central tech helping to promote and embed risk and compliance ownership across the business as well as to broaden and expand their knowledge base of both the internal and external risk environment.

  
  

• Drive continuous improvement of our risk assessment methodology.

  
  

• Be a "subject matter expert" in different risk and cybersecurity related domains including familiarity with industry-standard frameworks.

  
  

• Support the team to identify ways to increase their business impact and improve the team's product(s) and ways of working

• Liaise with other risk and audit teams (Risk and Controls, Internal Audit, external auditors, etc.) as needed

Information and Persuasion:

• Report progress on a monthly basis to the other Capability Area Leads in the Pillar; provide actionable feedback to other Capability Area Leads in the Pillar; work together with other capability area leads within and outside their pillar to drive overarching programs and to proactively find opportunities for improvement through collaboration.

Cooperation:

• Support peer team team members to identify ways to increase their business impact and improve the team's product(s) and ways of working

  
  

• Provide support and guidance for key initiatives in all Business Units and Functions.

  
  

• Design and implement IT controls to address security, privacy and compliance risks for IT infrastructure and systems.