Sr Manager - Technology Risk

Sr Manager - Technology Risk Application Risk Management (ARM)

In Corporate Risk Management (CRM), we provide an integrated risk management strategy that supports the delivery of predictable financial and operational performance in order to produce successful client and shareholder outcomes. We are organized around six primary functions: Bank Risk, Enterprise Risk, Information Security Risk Management, Market and Investment Risk, Model Risk and Operational Risk. Within each of these areas, we develop a framework for how much risk we are willing to accept as a firm and establish processes for identifying, evaluating, measuring, monitoring, and reporting against that framework. In Information Security Risk Management, we support that framework across information and technology to protect client assets, client information and firm assets.

The Sr Manager - Technology Risk Application Risk Management (ARM), as a second line of defense function, is responsible for a) proactively identifying, measuring, assessing and reporting application risk exposure, b) execute application risk management policy, oversee and assess adherence to policy, and report maturity progress to management, and c) assessing ongoing adherence to security standards and best practices by conducting recurring and ad-hoc risk assessments on platforms and applications.

Responsibilities include:

• Partner with development and business teams to assure policy compliance is communicated and path forward is understood.
• Conduct policy oversight, collaborating with business and development teams to document risk management requirements, assess application design and architecture for compliance with published standards, and perform risk assessments where appropriate.
• Maintain and evolve the measurement of KPI's/KRI's to monitor risk reduction.
• Assess the application risk management space on a periodic basis to evolve the strategy to adapt to emerging threats and capabilities.

Principle Duties and Responsibilities

• Provide Effective Challenge & Policy Oversight
• Develop and articulate secure application risk management strategies that continuously monitor and improve the security of customer-facing and internally facing applications. Effectively challenge 1st line of defense roadmaps to continuously improve responses to the changing risk landscape.
• Collaborate with business and technology teams to create and maintain application risk management policies and standards reflecting the firm's risk appetite and industry best practices to assure robust controls.
• Provide credible risk assessments and independent reporting
• Liaison with product management and technology to assure risk management requirements are considered throughout the project lifecycle and across the portfolio.
• Conduct oversight on identified vulnerabilities and remediation activities and provide reporting to business, technology, and risk management leaders. Provide support to keep mitigation plans on track for timely delivery.
• Participate in defining, executing, and maturing the Secure Software Development Lifecycle (SSDLC).
• Lead discussions with business units to review and approve mitigation strategies for vulnerabilities and areas of non-compliance with information security policy and standards.
• Work with internal auditors and regulators to articulate our application risk management framework, execution progress, and how application-level cybersecurity risks are managed at Schwab.
• Align with stakeholders from all three lines of defense regarding application and information security risks to the business units.
• Partner with risk, business, and technology leaders to identify key issues, trade-offs and impacts to planned investments and projects.
• Work closely with technology and business teams to establish acceptable risk thresholds and perform assessments against the firm's established risk appetite and approved thresholds.

What you have

• Bachelor's degree plus CISSP, CISM, or equivalent certification is preferred
• Direct experience working within Application Security, Development, Software Testing and Risk Management
• 3+ years of experience in a risk, supervision/controls, compliance, or audit function, preferably in financial services
• Knowledge of risk control frameworks such as NIST, ISO as well as regulatory and industry requirements such as GLBA, PCI, FFIEC
• Experience with data analysis and reporting
• Experience with authoring, maintaining, and implementing IS Policies and Standards
• Ability to effectively communicate with technical and executive audiences; both oral and written is required
• Experience with metrics and status reporting
• Experience analyzing data and preparing solutions based on sound facts and findings
• Thrive in a constantly evolving environment and meet critical commitments under pressure
• Ability to work independently and proactively, with minimum guidance
• Excellent interpersonal, written, and verbal communication skills; demonstrated presentation skills
• Sharp analytical skills and strong attention to detail and accuracy
• Experience with SAST, DAST, bug Bounty, Pen Test will be a plus
• Advanced degree such as MBA, professional designation such as CPA and/or prior Big 4 public accounting experience is preferred
• CISA, CISM, CRISC, or equivalent certification