Senior Technology Resilience Risk Oversight Leader

The position is described below. If you want to apply, click the Apply Now button at the top or bottom of this page. After you click Apply Now and complete your application, you'll be invited to create a profile, which will let you see your application status and any communications. If you already have a profile with us, you can log in to check status.

Need Help? ()

If you have a disability and need assistance with the application, you can request a reasonable accommodation. Send an email to Accessibility (careers@truist.com?subject=Accommodation%20request)

(accommodation requests only; other inquiries won't receive a response).

Regular or Temporary :

Regular

Language Fluency : English (Required)

Work Shift :

1st shift (United States of America)

Please review the following job description :

Leader within the Truist second-line-of-defense (LOD2) Technology Risk team responsible for independent risk oversight of technology resiliency. As a valuable teammate you will develop a trusted advisor relationship with technology leaders in assigned oversight areas, provide credible challenge focused on technology resiliency, perform risk identification and mitigation strategy development, partner with other internal teams to assess and mitigate technology risk and manage teammates to execute on technology risk oversight activities and grow their professional skillsets.

The Senior Technology Risk Officer Resiliency position is a senior risk leader role responsible for independently assessing and challenging the effectiveness of the firm's technology and cyber resilience programs. The successful candidate will leverage deep technical expertise and strong analytical skills to ensure critical business operations can withstand, adapt to, and recover from severe disruptions, such as cyberattacks, system failures, or natural disasters. This position focuses on all aspects of technology resiliency including, business continuity, disaster recovery and effective testing and measurement to appropriately mange the risk of resiliency at Truist. This role provides guidance and expert challenge to technology teams and executive leadership to ensure alignment with the firm's risk appetite and regulatory requirements.

Following is a summary of the essential functions for this job. Other duties may be performed, both major and minor, which are not mentioned below. Specific activities may change from time to time.

Technology Risk Leadership - Provide independent risk oversight (i.e. second line of defense / LOD2) enterprise-wide for Enterprise Control Functions through the effective identification, mitigation, monitoring and reporting of operational, technology, compliance and strategic risks within the ECFs;

Strategic Alignment- Provide strategic risk advisory to ECF leads, i.e. the Chief Information Security Officer, the Chief Data Officer, the Chief Technology Officer, etc that supports the Truist organization's strategies and objectives while operating within established risk appetites. Provide effective challenge of the ECF Strategy for Truist;

Industry engagement- lead engagement of peer institution second line functions to influence the industry build of the tech risk functions;

Targeted control testing- lead execution of independent second line testing / evaluations (e.g. Red Team / Penetration Testing); work is typically commissioned by the Board, the CEO and / or the CRO;

Value Delivery - Ensure that resources, activities and initiatives are aligned to enable and sustain achievement of business objectives within forecasted spend rates while reducing risks;

Provide independent assessment and oversight of the maturity of technology risk domains (e.g. Cyber, Service Delivery and Operations, Data Management, etc) and adequacy of controls pertaining to domains in meeting agreed to business outcomes for performance, stability, security and service availability. Assessments should leverage agreed upon metrics produced by Business Unit Risk Management (BURM) / first line of defense - LOD1) but challenged and validated as appropriate;

Independent Challenge of LOD1 assessments - Review and attest to / challenge adequacy of risk assessments (i.e. Risk & Control Self-Assessments, Application Assessments, Change Risk Assessments) produced by BURM;

Committee Engagement - Serve as member of the Technology Risk Committee and participate in the Enterprise and Board Risk Committees and the Board Technology Committee, when applicable for Technology Risk related topics;

Regulatory Engagement Oversight - Ensure effectiveness and structure in regulatory engagement practices, including responses out of the impacted ECF group;

Training and Communication - Encourage and monitor risk education, skills training and adoption of goals to drive improved risk culture and awareness across the enterprise;

Policy & Standard Leadership - Engage on ECF Risk policy governance, as well as, policies, standards, procedures owned by areas of oversight. Provide direction and guidance in the development, implementation and communication of policies, procedures and standards. Oversight of multiple enterprise-wide policies;

Third Party Management Risk Oversight - Monitor, assess and challenge as appropriate significant third-party and vendor relationships within Enterprise Technology;

Cross-Organizational Communication - Develop and maintain effective channels of communication with other BU CROs, control functions, Senior Business Unit (BU) management, as well as regulatory agencies;

Talent Management - Lead, manage and develop teammates directly and indirectly; influence cybersecurity talent management through recommendations to Truist senior leadership, including the Board of Directors, to inform decisions on resource allocations to close control gaps;

Participate in applicable mergers and acquisition target evaluation and develop independent risk analyses where needed

Qualifications

Required Qualifications :

The requirements listed below are representative of the knowledge, skill and / or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

Advanced degree in business or financial-related discipline, or equivalent education and related training

Twenty years of experience or equivalent proficiency in managing people with demonstrated high competency in recruiting, developing, and coaching / mentoring

Fifteen years of experience in a financial institution (or large corporate equivalent) with emphasis on risk management or equivalent work experience

Ten years of large ECF and related technology operations, including extensive knowledge of technology policy, procedures and regulations

Knowledge of key technology rules / regulations and technology risk management practices (e.g. Federal Financial Institutions Examination Council (FFIEC), Control Objectives for Information and Related Technology (COBIT), NIST (National Institute of Standards and Technology), Information Technology Infrastructure Library (ITIL)).

Strong leadership skills including the ability to lead direct and indirect teammates

Excellent communication (verbal and written), presentation and facilitation skills; ability to influence and communicate with impact

Experience presenting to Executive Leadership and Board level

Superior ability to think critically and strategically

Preferred Qualifications :

Twenty years of experience in a financial institution with emphasis on risk management or equivalent work experience

Professional designations such as Certified Information Systems Auditor (CISA), Certified in Risk and Information Systems Control (Information Systems Audit and Control Association) (CRISC), Certified Project Manager (CPM)

Strategic business and financial planning experience

Experience with audit processes and techniques

Master's degree in Business Administration (MBA) or advanced degree in Business Management, Technology or Finance.

Familiarity in application and execution of financial services technology-related laws, rules, regulations, and risk management standards (e.g. Federal Financial Institutions Examination Council (FFIEC), Control Objectives for Information and Related Technology (COBIT), Information Technology Infrastructure Library (ITIL)).

Familiarity with risk measurement approaches including development of Key Risk Indicators and thresholds and associated reporting and analytics tools (e.g. Tableau, RSA Archer).

Technical expertise : Advanced knowledge of core infrastructure technologies (e.g., cloud, networking, databases, storage, data center management), concepts including SRE, Chaos Testing and other applicable IT resilience principles, and industry control frameworks (e.g., NIST, ISO27001, FDIC Operational Resilience).

Risk management knowledge : In-depth practical knowledge of risk assessment methodologies, control evaluation, and reporting.

Communication skills : Excellent written and verbal communication skills with the ability to influence stakeholders at all levels of the organization.

Problem-solving : Strong analytical, problem-solving, and decision-making skills in a fast-paced and high-pressure environment.

General Description of Available Benefits for Eligible Employees of Truist Financial Corporation : All regular teammates (not temporary or contingent workers) working 20 hours or more per week are eligible for benefits, though eligibility for specific benefits may be determined by the division of Truist offering the position. Truist offers medical, dental, vision, life insurance, disability, accidental death and dismemberment, tax-preferred savings accounts, and a 401k plan to teammates. Teammates also receive no less than 10 days of vacation (prorated based on date of hire and by full-time or part-time status) during their first year of employment, along with 10 sick days (also prorated), and paid holidays. For more details on Truist's generous benefit plans, please visit our Benefits site ()

• . Depending on the position and division, this job may also be eligible for Truist's defined benefit pension plan, restricted stock units, and / or a deferred compensation plan. As you advance through the hiring process, you will also learn more about the specific benefits available for any non-temporary position for which you apply, based on full-time or part-time status, position, and division of work.

Truist is an Equal Opportunity Employer that does not discriminate on the basis of race, gender, color, religion, citizenship or national origin, age, sexual orientation, gender identity, disability, veteran status, or other classification protected by law. Truist is a Drug Free Workplace.

EEO is the Law ()

E-Verify ()

IER Right to Work ()