Sr. Manager, Information Risk & Controls

About Invesco

As one of the world’s leading independent global investment firms, Invesco is dedicated to rethinking possibilities for our clients. By delivering the combined power of our distinctive investment management capabilities, we provide a wide range of investment strategies and vehicles to our clients around the world. If you’re looking for challenging work, intelligent colleagues, and exposure across a global footprint, come explore your potential at Invesco.

What’s in it for you

Our people are at the very core of our success. Invesco employees get more out of life through our comprehensive compensation and benefit offerings including:

• Flexible paid time off
• Hybrid work schedule
• 401(K) matching of 100% up to the first 6% with a discretionary supplemental contribution
• Health & wellbeing benefits
• Parental Leave benefits
• Employee stock purchase plan

Job Description

In the Enterprise Risk Management (ERM) function, we are looking for a Sr. Manager of Information Risk and Controls to drive the evolution of our risk management framework. The role supports the Global Head of Information Risk and Controls in overseeing, evaluating, and enhancing the effectiveness of the second line of defense while improving the execution of the first line of defense in managing information risks.

About the Department/Team

Enterprise Risk is a global Second Line of Defense function that engages with Invesco Business teams to facilitate delivery and oversight of the risk management framework and provide a consistent, aligned approach to risk management across the firm.

About the Role

The Sr. Manager of Information Risk and Controls is a leadership and expert role responsible for advancing risk management evolution. This individual will support the Global Head of Information Risk and Controls in overseeing, evaluating, and enhancing the effectiveness of the second line of defense while improving the execution of the first line of defense in managing information risks.

Responsibilities

• Leading Risk Identification and Mitigation: Spearhead the identification, assessment, and mitigation of technology, cybersecurity, data, and privacy risks, including those tied to infrastructure, cloud, and AI/ML technologies, data governance, data quality, data lineage, cyber threats, evolving privacy regulations, and emerging risks.
• Framework Implementation: Develop and implement a robust information risk and control framework to enhance the firm’s second line of defense capabilities in overseeing information security, data governance, and technology risks.
• Risk Analysis and Monitoring: Analyze current and emerging information security, data governance, and technology risks, developing KRIs to monitor the adequacy, quality, and efficacy of controls.
• Collaboration and Oversight: Partner with data owners, stewards, technology teams, Internal Audit, Global Compliance, and Risk teams to review and strengthen the control environment and provide independent second-line checks.
• Policy and Governance Leadership: Lead the development and implementation of risk management policies, procedures, and governance structures.
• Industry Engagement: Engage with industry networks and associations to stay on developments in technology, operational, data governance, security risk management.
• Risk Awareness: Drive risk awareness among employees through training and education.
• Team Leadership: Provide strategic leadership to the Information Risk Management team, fostering continuous improvement and excellence.

Requirements

• 7–10 years of risk and control experience, with at least 5 years driving risk management across various lines of defense in a global banking/financial services environment or international risk consulting.
• Strong understanding of complex technology, data governance, and cybersecurity concepts, including core technology and security principles.
• Hands‑on experience defining and implementing information risk management and control frameworks, emphasizing integration of data governance.
• Experience with major cybersecurity, technology, operational risk, and data governance frameworks and standards such as NIST CSF, CRI Cybersecurity Profile, CSA Cloud Controls, CCM, ISO 27000 series, COBIT, and Basel Operational Risk Principles. Experience delivering and assessing security solutions across major cloud service providers (AWS, Azure, GCP).
• Excellent communication skills with the ability to build consensus through data‑driven, factual communication.
• Advanced analytical skills with the ability to exercise judgment and solve complex problems.
• Team‑player with strong leadership skills and the ability to work well in a dynamic, team‑oriented environment.
• Preference for candidates with asset‑management or financial services industry experience.
• Working knowledge of current and emerging technologies, including cloud computing, AI/ML, and automation tools.
• Undergraduate degree required; MBA or master’s degree preferred.
• Certification in at least one of the following: CRISC, CISSP, CISA, CISM, CIPP, etc.

Full‑Time / Part‑Time

Full time

Worker Type

Employee

Job Exempt

Yes

Workplace Model

Employees are expected to spend at least four full days each week working in an Invesco office.

Invesco’s culture of inclusivity and its commitment to diversity in the workplace are demonstrated through our people practices. We are proud to be an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, creed, color, religion, sex, gender identity, sexual orientation, marital status, national origin, citizenship status, disability, age, or veteran status. Our equal opportunity employment efforts comply with all applicable U.S. state and federal laws governing non‑discrimination in employment.