Technology Risk and Controls Manager – Senior Associate

 

Description

We know that people want great value combined with an excellent experience from a bank they can trust, so we launched our digital bank, Chase International, to revolutionize mobile banking with seamless journeys that our customers love. We’re already trusted by millions in the US and we’re quickly catching up in the UK – but how we do things here is a little different. We’re building the bank of the future from scratch, channelling our start-up mentality every step of the way – meaning you’ll have the opportunity to make a real impact.

 

Join us and help protect what matters most. As part of our security team, you’ll grow your skills, collaborate with talented colleagues, and make a real impact on our technology risk management efforts. We offer a supportive environment where you can develop your career and contribute to a culture of innovation and security. Be part of a team that values your curiosity and commitment to excellence.

 

Job Summary:

As a Tech Risk and Controls Senior Associate at International Consumer Banking within the Cybersecurity Technology and Controls, you will be responsible for the LOB risk assessment, governance, standardization, and measurement across all the Cyber domains. Your primary focus will be leading and managing the Security Configuration Management domain. This role ensures that foundational and advanced controls across platform, network, endpoint and application security configuration are governed by clearly defined standards and measurable control objectives. This position blends deep technical understanding of controls and tooling with architectural oversight and governance rigor ensuring that the firm’s operational controls are consistently engineered, validated, and improved especially across cloud‑native environments.

 

While we’re looking for professional skills, culture is just as important to us. We understand that everyone's unique – and that diversity of thought, experience and background is what makes a good team, great. By bringing people with different points of view together, we can represent everyone and truly reflect the communities we serve. 

 

Job Responsibilities:

• LOB cyber risk leadership: Act as the primary cybersecurity and technology risk point-of-contact for the LOB Applications, shaping priorities, escalation paths, and governance routines across the application/platform portfolio.
• Control objectives & standards (AWS / configuration security): Lead the development, tailoring, and adoption of technical control objectives and standards for Security Configuration Management and other cyber domains (identity, logging/monitoring, vulnerability management, network security), ensuring applicability to LOB architectures and delivery models.
• Risk identification & decision support (with approved AI): Leverage enterprise-authorized AI capabilities to accelerate architecture risk analysis, threat/risk identification, and documentation; validate outputs and handle data per sensitivity and security requirements.
• Control performance & effectiveness metrics: Define measurable control performance and effectiveness metrics per control category; integrate telemetry, automation signals, and operational KPIs into LOB governance dashboards to provide clear, outcome-based visibility.
• Evidence, reporting, and audit readiness (with approved AI): Use enterprise-authorized AI capabilities to accelerate synthesis of risk/control evidence and draft executive-ready reporting; ensure human review, traceability, and auditability of conclusions.
• Issue and action-plan leadership: Drive reuse-first, AI-assisted routines for recurring control testing, deficiency management, and action-plan execution; ensure closure evidence meets internal audit and regulatory expectations.
• Partnering and challenge function (within LOB): Partner with engineering and operations to evaluate control sufficiency against threat models, regulatory expectations, and internal policies; provide credible challenge and pragmatic remediation options.
• Hybrid control governance: Govern control implementation and sustainment across AWS cloud, data center, and endpoint ecosystems used by the LOB, ensuring consistent security posture and minimizing control drift.
• Tooling integration into GRC: Assess and guide integration of configuration drift and security tooling (e.g., Evolven, Puppet, Chef, Wiz or equivalents) with the firm’s GRC ecosystem to support standardized control objectives, testing, and evidence capture.
• Strategic insights for LOB leadership: Provide clear posture assessments, trend analysis, and forward-looking risk insights to LOB technology leadership and risk governance forums; drive continuous improvement in control efficiency and effectiveness.

 

Required Qualifications, Capabilities, and Skills:

• Experience in LOB-aligned technology risk and/or cybersecurity control leadership, including influencing delivery teams and driving execution through governance and remediation.
• Strong working knowledge of AWS security controls and services (e.g., IAM, Organizations/SCPs, CloudTrail, Config, GuardDuty, Security Hub, KMS, VPC) and how they support auditable control outcomes.
• Demonstrated ability to translate policy/standards into implementable, testable controls; define evidence requirements; and communicate risk clearly to both engineers and executives.
• Proven experience managing control testing cycles, issue remediation, and executive reporting in an audit- and regulatory-facing environment.
• Strong stakeholder management across product, engineering, operations, architecture, and risk partners; ability to lead through influence.

 

Preferred Qualifications, Capabilities, and Skills:

• CISM, CRISC, CISSP, or similar industry-recognized risk certifications