Tech Risk & Controls Lead - Vulnerability Management

Salary: $61,000 - 101,000 per year Requirements:

• Formal training or certification in technology risk and controls, plus 10+ years of applied experience in cybersecurity, technology risk, Vulnerability Management, security engineering, product or service governance, or controls leadership, including cross-organizational leadership
• Experience establishing or leading enterprise Vulnerability Management governance, a control tower, service integration, or comparable cross-functional oversight
• Deep knowledge of the Vulnerability Management lifecycle, including asset and provider coverage, discovery, scanning, intake, triage, risk rating, routing, remediation, exceptions, validation, reporting, and closure
• Ability to define decision rights, governance forums, RACI models, change-control gates, materiality criteria, escalation mechanisms, evidence requirements, and outcome-based metrics
• Experience overseeing complex Vulnerability Management ecosystems and data flows across multiple tools, providers, platforms, and hybrid environments
• Strong analytical skills in discovery and coverage efficacy, root-cause and thematic analysis, control effectiveness, data quality, and enterprise risk reporting
• Executive presence and skill in constructive challenge, resolving accountability gaps, influencing senior stakeholders, and explaining complex technical and risk topics in business terms
• Experience supporting Audit, Compliance, Operational Risk, and regulatory engagements, with strong evidence, decision-traceability, issue-management, and audit-documentation practices
• Working knowledge of governance, risk, and compliance platforms; Vulnerability Management technologies; cloud and container security; enterprise data and reporting tools; and automated control monitoring
• Experience applying enterprise-authorized AI capabilities to cybersecurity risk and controls workflows, with rigorous validation, data-sensitivity awareness, and human accountability
• Preferred: Professional certifications such as CISSP, CISM, CRISC, GIAC, or relevant cloud security certifications
• Preferred: Experience in large, complex financial services or regulated environments subject to substantial regulatory and audit scrutiny
• Preferred: Familiarity with AI-enabled governance tools and automation for control monitoring, evidence synthesis, and executive reporting
• Preferred: Exposure to enterprise risk frameworks, regulatory requirements, and industry standards relevant to Vulnerability Management and cybersecurity controls
• Preferred: Experience designing or contributing to enterprise communications for governance decisions, systemic issues, and executive reporting

• Lead our enterprise Vulnerability Management governance function as a central point for cross-functional accountability, governance challenge, and escalation
• Establish and maintain our governance charter, operating model, decision rights, forums, RACI, materiality thresholds, and escalation paths
• Coordinate collaboration across product, engineering, operations, risk intelligence, standards and control design, control owners, Product Security, and business teams while preserving technical and remediation ownership
• Chair or coordinate governance forums, ensuring working groups prepare complete evidence and decision-making bodies document accountable, timely, traceable outcomes
• Govern material changes to discovery, coverage, feeds, integrations, scoring, filtering, bundling, exemptions, and inclusion or exclusion rules through impact assessment, testing, approval, communication, and post-implementation validation
• Lead systemic root-cause and thematic analysis of vulnerabilities, control failures, recurring defects, data-quality issues, and finding concentrations, translating insights into owned and tracked enterprise corrective actions
• Define and oversee enterprise metrics and reporting on discovery and coverage efficacy, control outcomes, governance health, service performance, rule compliance, remediation trends, and downstream impact
• Coordinate responses to systemic issues while ensuring local remediation, exception, and risk-acceptance decisions remain with the appropriate control and business owners
• Partner with our Vulnerability Management Product or Service Owner on strategy, roadmap, prioritization, capability improvement, annual coverage review, and distinguishing routine improvements from material enterprise changes
• Work with Audit, Compliance, Operational Risk, and regulatory engagement teams so our leaders can provide coherent, evidence-based explanations of firmwide scope, methodology, control outcomes, and material decisions
• Advance automation, reusable governance practices, and auditable workflows to improve the quality, timeliness, and traceability of decisions and follow-through

• AI
• Cloud
• Support
• Marketing
• Security

More:

We are hiring a Tech Risk and Controls Lead in our Cybersecurity Technology and Controls organization to guide enterprise governance of Vulnerability Management. This role connects teams and strengthens oversight across cloud, data center, endpoint, application, container, and other technology environments, without taking over technical execution or remediation accountability. JPMorganChase is a longstanding financial institution serving consumers, small businesses, and prominent corporate, institutional, and government clients through the J.P. Morgan and Chase brands. Our businesses include investment banking, consumer and small business banking, commercial banking, financial transaction processing, and asset management. Our Corporate Functions teams span areas such as finance, risk, human resources, and marketing, supporting our businesses, clients, customers, and employees. We offer a competitive total rewards package, with compensation based on role, experience, skills, and location; eligible roles may also receive commission-based pay or discretionary incentives. Benefits, subject to eligibility, include health coverage, on-site wellness centers, retirement savings, backup childcare, tuition reimbursement, mental health support, and financial coaching. We value diversity and inclusion, are an equal opportunity employer, and provide reasonable accommodations for religious practices and beliefs and for mental or physical disability needs.

last updated 42 week of 2026