technology risk analyst

BluePath Labs

<div>Analyst II
Location: Washington, DC
Clearance: TS/SCI or able to obtain
BluePath Labs is a fast-growing research and consulting company committed to solving complex problems for federal, state, and local government clients. We offer a range of professional, scientific, and technology services. Our specific areas of expertise include business consulting, research and data science, and technology integration.
We are actively seeking a TS/SCI&ndash;cleared Analyst II to support the Department of Energy (DOE), Office of International Affairs in its mission to protect federal investments from undue foreign influence and to accomplish its mission in ways that protect and further energy security and technological advancement of the United States. This role plays a crucial part in safeguarding DOE investments from actors that do not adhere to the global norms of science and seek to acquire knowledge and technology for their own benefit, as well as malign foreign influence.
Work Description:
In support of this office, strong candidates will demonstrate expertise in due diligence reviews related to research, technology and economic security. The analyst will conduct comprehensive due diligence reviews and provide actionable insights to mitigate risks associated with foreign influence, supply chains, and technology transfer. The successful candidate must be capable of thriving in a fast-paced environment, taking the initiative, tracking progress, and providing practical, timely solutions.
Responsibilities: The Analyst II will support tasks such as:<ul><li>
Perform comprehensive due diligence reviews related to RTES, including:<ul><li>
Open-source intelligence on corporate ownership, control, and influence</li><li>
Supply chain risk assessments</li><li>
Identification of malign foreign influence</li><li>
Evaluation of conflicts of commitment and interest</li><li>
Analysis of technology transfer risks and potential intellectual property theft</li></ul></li><li>
Use data analytics platforms to enhance the analysis and interpretation of data to provide actionable insights into business decisions and reporting</li><li>
Communicate identified risks effectively to stakeholders</li><li>
Prepare detailed written deliverables documenting findings and recommendations</li><li>
Develop and maintain strong interpersonal relationships with stakeholders</li></ul>
Minimum Requirements:
<ul><li>Possess a TS/SCI or Q security clearance or ability to obtain one</li><li>
5+ years of experience</li><li>
Bachelor's degree or demonstrated expertise in RTES-related risk analysis and due diligence</li><li>
Understanding of regulations and authorities related to the Department and Energy and RTES, including but not limited to NSPM-33 and CHIPS and Science Act</li><li>
Experience using Excel, Power BI, Python and other advanced data analysis tools</li><li>
Excellent written and verbal communication skills for risk reporting and stakeholder engagement</li></ul>
Benefits:
BluePath Labs offers a comprehensive benefits package. Benefits include, but are not limited to: employer-sponsored healthcare plan, lifestylewellness reimbursement, Flexible Spending Account (FSA), tuition assistance, 401(k) with company match, and paid time off for vacation / sick leave, in addition to 12 holidays per calendar year.
About BluePath
BluePath Labs combines mission and business insights with advanced technologies to deliver measurable performance improvements for our clients. BluePath is dedicated to surpassing client expectations by always living by our core values of integrity, professionalism, and resilience. BluePath's extensive experience in Government, Military, Commercial, and Academic environments is unique among small businesses and a core differentiator of our solutions. Our multidisciplinary background allows us to solve diverse and complex problems. Most importantly, we work closely with our clients to frame problems correctly, optimize processes, leverage technologies, and implement enduring solutions. Labs are where ideas are born, experiments occur, and breakthroughs happen. It is the hallmark of BluePath's culture.
https://www.bluepathlabs.com/
BluePath Labs is an equal opportunity employer.</div>

Analyst II

<div>Analyst IV
Location: Washington, DC
Clearance: TS/SCI or Q
BluePath Labs is a fast-growing research and consulting company committed to solving complex problems for federal, state, and local government clients. We offer a range of professional, scientific, and technology services. Our specific areas of expertise include business consulting, research and data science, and technology integration.
We are actively seeking a TS/SCI&ndash;cleared Analyst IV to support our clients at the Department of Energy (DOE), Office of International Affairs in its mission to protect federal investments from undue foreign influence and to accomplish its mission in ways that protect and further energy security and technological advancement of the United States. This role plays a crucial part in safeguarding DOE investments from actors that do not adhere to the global norms of science and seek to acquire knowledge and technology for their own benefit, as well as malign foreign influence.
Work Description:
In support of this office, strong candidates will demonstrate expertise in due diligence reviews related to research, technology and economic security. The successful candidate will lead and supervise a team of risk analysts ensuring high-quality risk assessments and actionable recommendations are delivered to DOE leadership. Candidates must be capable of thriving in a fast-paced environment, taking the initiative, tracking progress, and providing practical, timely solutions.
Responsibilities: The Analyst IV will support tasks such as:<ul><li>
Supervise and mentor a team of Risk Analysts, ensuring accuracy, consistency, and quality in all outputs</li><li>
Perform comprehensive due diligence reviews related to RTES, including:<ul><li>
Open-source intelligence on corporate ownership, control, and influence</li><li>
Supply chain risk assessments</li><li>
Identification of malign foreign influence</li><li>
Evaluation of conflicts of commitment and interest</li><li>
Analysis of technology transfer risks and potential intellectual property theft</li></ul></li><li>
Use data analytics platforms to enhance the analysis and interpretation of data to provide actionable insights into business decisions and reporting</li><li>
Communicate identified risks effectively to stakeholders</li><li>
Prepare detailed written deliverables documenting findings and recommendations</li><li>
Develop and maintain strong interpersonal relationships with stakeholders and engage in effective stakeholder management</li></ul>
Minimum Requirements:
<ul><li>Possess a TS/SCI or Q security clearance</li><li>
15+ years of experience</li><li>
Bachelor's degree or demonstrated expertise in RTES-related risk analysis and due diligence</li><li>
Possess significant understanding of regulations and authorities related to the Department and Energy and RTES, including but not limited to NSPM-33 and CHIPS and Science Act</li><li>
Expertise using Excel, Power BI, Python and other advanced data analysis tools</li><li>
Excellent written and verbal communication skills for risk reporting and stakeholder engagement</li><li>
Leadership experience managing analytical teams</li></ul>
Benefits:
BluePath Labs offers a comprehensive benefits package. Benefits include, but are not limited to: employer-sponsored healthcare plan, lifestylewellness reimbursement, Flexible Spending Account (FSA), tuition assistance, 401(k) with company match, and paid time off for vacation / sick leave, in addition to 12 holidays per calendar year.
About BluePath
BluePath Labs combines mission and business insights with advanced technologies to deliver measurable performance improvements for our clients. BluePath is dedicated to surpassing client expectations by always living by our core values of integrity, professionalism, and resilience. BluePath's extensive experience in Government, Military, Commercial, and Academic environments is unique among small businesses and a core differentiator of our solutions. Our multidisciplinary background allows us to solve diverse and complex problems. Most importantly, we work closely with our clients to frame problems correctly, optimize processes, leverage technologies, and implement enduring solutions. Labs are where ideas are born, experiments occur, and breakthroughs happen. It is the hallmark of BluePath's culture.
https://www.bluepathlabs.com/
BluePath Labs is an equal opportunity employer.</div>

Analyst IV

<div>Analyst II
Location: Remote &ndash; in the following states only: AL, AK, AZ, AR, CT, DE, FL, GA, HI, ID, IN, IA, KS, KY, LA, ME, MD, MI, MS, MO, MT, NE, NV, NH, NM, NC, ND, OH, OK, OR, PA, RI, SC, SD, TN, TX, UT, VA, WV, WI, WY
Clearance: None required
BluePath Labs is a fast-growing research and consulting company committed to solving complex problems for federal, state, and local government clients. We offer a range of professional, scientific, and technology services. Our specific areas of expertise include business consulting, research and data science, and technology integration.
We are actively seeking a TS/SCI&ndash;cleared Analyst II to support the Department of Energy (DOE), Office of International Affairs in its mission to protect federal investments from undue foreign influence and to accomplish its mission in ways that protect and further energy security and technological advancement of the United States. This role plays a crucial part in safeguarding DOE investments from actors that do not adhere to the global norms of science and seek to acquire knowledge and technology for their own benefit, as well as malign foreign influence.
Work Description:
In support of this office, strong candidates will demonstrate expertise in due diligence reviews related to research, technology and economic security. The analyst will conduct comprehensive due diligence reviews and provide actionable insights to mitigate risks associated with foreign influence, supply chains, and technology transfer. The successful candidate must be capable of thriving in a fast-paced environment, taking the initiative, tracking progress, and providing practical, timely solutions.
Responsibilities: The Analyst II will support tasks such as:<ul><li>
Perform comprehensive due diligence reviews related to RTES, including:<ul><li>
Open-source intelligence on corporate ownership, control, and influence</li><li>
Supply chain risk assessments</li><li>
Identification of malign foreign influence</li><li>
Evaluation of conflicts of commitment and interest</li><li>
Analysis of technology transfer risks and potential intellectual property theft</li></ul></li><li>
Use data analytics platforms to enhance the analysis and interpretation of data to provide actionable insights into business decisions and reporting</li><li>
Communicate identified risks effectively to stakeholders</li><li>
Prepare detailed written deliverables documenting findings and recommendations</li><li>
Develop and maintain strong interpersonal relationships with stakeholders</li></ul>
Minimum Requirements:
<ul><li>Possess a TS/SCI or Q security clearance or ability to obtain one</li><li>
5+ years of experience</li><li>
Bachelor's degree or demonstrated expertise in RTES-related risk analysis and due diligence</li><li>
Understanding of regulations and authorities related to the Department and Energy and RTES, including but not limited to NSPM-33 and CHIPS and Science Act</li><li>
Experience using Excel, Power BI, Python and other advanced data analysis tools</li><li>
Excellent written and verbal communication skills for risk reporting and stakeholder engagement</li></ul>
Benefits:
BluePath Labs offers a comprehensive benefits package. Benefits include, but are not limited to: employer-sponsored healthcare plan, lifestylewellness reimbursement, Flexible Spending Account (FSA), tuition assistance, 401(k) with company match, and paid time off for vacation / sick leave, in addition to 12 holidays per calendar year.
About BluePath
BluePath Labs combines mission and business insights with advanced technologies to deliver measurable performance improvements for our clients. BluePath is dedicated to surpassing client expectations by always living by our core values of integrity, professionalism, and resilience. BluePath's extensive experience in Government, Military, Commercial, and Academic environments is unique among small businesses and a core differentiator of our solutions. Our multidisciplinary background allows us to solve diverse and complex problems. Most importantly, we work closely with our clients to frame problems correctly, optimize processes, leverage technologies, and implement enduring solutions. Labs are where ideas are born, experiments occur, and breakthroughs happen. It is the hallmark of BluePath's culture.
https://www.bluepathlabs.com/
BluePath Labs is an equal opportunity employer.</div>

Analyst II - NC

Semperis

<div>
 
 At Semperis, our mission is to be a Force for Good. Starting with being a great place to work.
 
 We believe that when people feel valued, supported, and empowered, they do their best work. That&rsquo;s why we focus on creating an employee experience rooted in purpose, growth, and balance. Semperis has been recognized as one of America&rsquo;s Fastest-Growing Cybersecurity Companies by the Inc. 5000, a DUNS 100 Top Startup to Work For, and a multi-year Inc. Best Workplace awardee.
 
 
 <ul>
 <li>
 Please Note all Requirements! Hybrid role
 </li>
 <li>
 We cannot sponsor at this time
 
 
 </li>
 </ul>
 Semperis is looking for a detail-oriented and analytical
 
 Cyber Risk Analyst
 
 to join our Security &amp; Risk team. In this role, you will play a crucial part in safeguarding the organization's assets and ensuring operational resilience by identifying and assessing potential Cyber Risks of all incoming vendors, third parties, services, and technology. You will collaborate with cross-functional teams and third-party vendors and providers, to request, collect, and analyze pertinent information and collateral, assess Cyber Risks, and recommend or require effective Cyber Risk control strategies.
 
 
 
 Position Summary
 
 
 
 The Technology Risk Analyst is responsible for protecting the organization by identifying, assessing, and mitigating risks across our technology environment, including applications, infrastructure, and third-party vendors. They use data and analytical models to forecast potential outcomes, advise management on strategic decisions, and develop control plans to minimize losses. A critical function of this role is to manage technology risk ensuring all deviations from policy &amp; standards are properly documented, compensated, and reviewed. This role requires strong familiarity with GRC concepts, modern GRC tools, and hands-on experience in risk analysis mitigation and compliance assurance.
 
 
 
 Key Responsibilities
 
 
 
 
 Risk Management
 
 
 
 <ul>
 <li>
 Risk Identification &amp; Assessment: Conduct technology risk assessments across new and existing applications, Review submitted risk exception requests, validate technical necessity, evaluate proposed compensating controls, and assign residual risk ratings (High, Medium, Low).
 </li>
 <li>
 Documentation: Ensure comprehensive, auditable documentation is maintained for all approved, denied, and conditionally approved exceptions, including mandatory review dates and resolution plans.
 </li>
 <li>
 Data Analysis and Modeling: Collect, process, and interpret multiple sources of data to model Cyber Risk scenarios, forecast potential outcomes, and evaluate Cyber Risk exposure. Translate technical findings into clear, measurable business risk statements for audience in multiple disciplines including leadership, customers and technical delivery teams.
 </li>
 <li>
 Monitoring: Track risk plan milestones and drive issue management initiating timely follow-ups with Business Owners to ensure our controls are adequate, compliance is assured and overall risk goals are met.
 </li>
 <li>
 Remediation Support: Develop mitigation strategies, recommend strategies to reduce, transfer, or avoid identified Cyber Risks - such as implementing new policies, controls, or processes. Collaborate with other teams to define and prioritize remediation efforts based on risk severity and business impact.
 </li>
 <li>
 Process improvement: Improve and automate Risk management process, working with the security and risk leadership teams.
 
 
 </li>
 </ul>
 
 Third party Risk Management (VRM)
 
 
 
 <ul>
 <li>
 3rd party Due Diligence: Perform security assessments of new and existing third-party vendors and service providers, reviewing security attestations (e.g., SOC 2, ISO 27001) and security questionnaires.
 </li>
 <li>
 Risk Analysis: Assess incoming compliance artifacts provided by third parties and research external sources to develop comprehensive risk assessments including risk scoring metrics.
 </li>
 <li>
 Risk Reporting: Document and communicate inherent and residual risks associated with vendor reliance and data handling practices. Prepare detailed reports, summaries, and presentations for management and stakeholders to communicate findings, recommendations, and trends.
 
 
 </li>
 </ul>
 
 GRC Automation &amp; Process Improvement
 
 
 
 <ul>
 <li>
 Tooling: Utilize and manage the corporate GRC platform and risk management tools to streamline risk workflows, automate control monitoring, and improve reporting efficiency.
 </li>
 <li>
 Automation: Identify opportunities to automate manual GRC tasks, specifically integrating risk tracking and control evidence gathering into GRC tools.
 
 
 </li>
 </ul>
 
 Policy, Compliance &amp; Customer Support
 
 
 
 <ul>
 <li>
 Respond to customer, partner or compliance questionnaires related to product security. This will involve Liaoning with product teams and other knowledge sources to maintain a knowledge library, utilizing a combination of AI, manual &amp; automated process to prepare SQ responses according to SLA expectations.
 </li>
 <li>
 Standard Maintenance: Support the Risk &amp; InfoSec team in reviewing, updating, and aligning IT Security Policies, Standards, and Procedures with regulatory requirements and industry best practices.
 </li>
 <li>
 Audit Readiness: Assist in gathering evidence and documentation required for internal and external security audits and compliance reviews.
 </li>
 <li>
 Stay updated with industry trends, regulatory changes, and compliance standards to ensure the organization adheres to all legal and regulatory requirements
 
 
 </li>
 </ul>
 
 Required Skills And Qualifications
 
 
 
 <ul>
 <li>
 Experience: 5+ years of relevant experience in Information Security, IT Risk Management, IT Audit, or GRC, with a heavy focus on technology risk.
 </li>
 <li>
 GRC Expertise: Deep working knowledge of key GRC concepts, risk assessment methodologies, and industry frameworks (e.g., NIST SP 800-53/CSF, ISO 27001).
 </li>
 <li>
 GRC Tooling: Proven, hands-on experience using and configuring modern GRC platforms for risk management, policy management, and compliance automation. Experience in configuring and using tools such as Archer, ServiceNow, MetricStream or Vanta preferred.
 </li>
 <li>
 Technical Proficiency: Experience with IT and Security tools, SaaS / other Cloud technologies and/or software development. Understanding of Security Controls, and cross-discipline cybersecurity, endpoint, network, data, identity, access management, privacy, accessibility, etc. concepts. Clear understanding of foundational Information Protection concepts is required.
 </li>
 <li>
 Analytical Skills: Exceptional ability to analyze complex technical vulnerabilities and control failures/gaps, translating them into measurable business risk, with detailed quantitative assessment skills to support findings &amp; recommendations.
 </li>
 <li>
 Communication: Excellent written and verbal communication skills, including the ability to communicate technical risk concepts effectively to both technical and executive audiences.
 </li>
 <li>
 Certifications: CRISC, CISM, CISA, or similar recognized security and risk management certifications.
 </li>
 <li>
 Education: Bachelor&rsquo;s degree in computer science, Information Security, or a related field.ot be sufficient)
 
 
 </li>
 </ul>
 
 Why Join Semperis?
 
 
 
 You&rsquo;ll be part of a global team on the front lines of cybersecurity innovation. At Semperis, we celebrate curiosity, integrity, and people who take initiative. If you&rsquo;re someone who sees the glass as half full, embraces challenges as growth opportunities, and values a healthy balance between work and life&mdash;we&rsquo;d love to meet you.
 
 
 <ul>
 <li>
 Semperis maintains office locations in several cities across the globe. Candidates who reside within 45 miles of one of our offices&mdash;or where the job description specifies a required location&mdash;will follow our hybrid work model. This includes working onsite three days per week and remotely the remaining days.
 
 
 </li>
 </ul>
 Semperis is an equal opportunity employer and will not discriminate against an applicant or employee based on race, color, religion, creed, national origin or ancestry, ethnicity, sex (including gender, pregnancy, sexual orientation, and gender identity), age, physical or mental disability, veteran or military status, genetic information, citizenship, marital status, or any other legally recognized protected basis under federal, state, or local law. The information collected by the Semperis application is solely to determine suitability for employment, verify identity, and maintain employment statistics.
 
 
 Applicants with disabilities may be entitled to reasonable accommodation under the Americans with Disabilities Act and/or other applicable state or local laws. A reasonable accommodation is a change in the way things are normally done which will ensure an equal employment opportunity without imposing undue hardship on Semperis. Please inform Semperis representative Anna Taylor, Director of Global Recruiting, if you need assistance completing this application or to otherwise participate in the application process.
 
 
</div>

Cyber Risk Analyst

<div>Line of Service
Internal Firm Services
Industry/Sector
Specialism
Management Level
Senior Associate
Job Description &amp; Summary
<div><div>About the Role
</div><div>Our Technology Risk and Resilience team helps firms navigate a fast-moving regulatory landscape while managing robust, future-proof technology estates. From shaping digital resilience frameworks under the Digital Operational Resilience Act (DORA) to helping firms enhance their technology risk maturity, we combine deep sector insight with leading technology to solve problems alongside our clients. 
</div><div>What You&rsquo;ll Be Doing
</div><div><ul><li>Supporting the engagement manager and broader team in delivering technology risk and resilience advisory engagements.
</li></ul></div></div><div><div><ul><li>Performing control walkthroughs, sample testing, and evidence review across technology risk and resilience domains.
</li></ul></div><div><ul><li>Drafting gap analysis and maturity assessment artefacts aligned to frameworks such as COBIT, ITIL, NIST CSF, ISO 27001/22301.
</li></ul></div><div><ul><li>Assisting with regulatory readiness and assurance projects, including resilience assessments under DORA and other EU/UK regulations.
</li></ul></div><div><ul><li>Preparing working papers and contributing to reports for clients, regulators, and internal stakeholders.
</li></ul></div><div><ul><li>Supporting risk advisory and assurance engagements, ensuring resilience objectives are embedded in technology change and operations.
</li></ul></div><div><ul><li>Using platforms like ServiceNow for resilience-related analysis and reporting.
</li></ul></div><div><ul><li>Engaging with the firm&rsquo;s digital agenda, leveraging AI tools to enhance risk monitoring and resilience testing.
</li></ul></div><div><ul><li>Contributing to cloud and DevOps risk assessments, ensuring secure, compliant, and recoverable environments.
</li></ul></div><div><ul><li>Assisting with business development activities such as preparing responses to tenders and creating proposal documents.
</li></ul></div><div><ul><li>Building trusted relationships with client SMEs and control owners.
</li></ul></div><div><ul><li>Coaching junior team members and supporting their development.
</li></ul></div><div><ul><li>Taking ownership of your personal development to ensure you are equipped with skills relevant to the proposition now and in the future. 
</li></ul></div><div>What We&rsquo;re Looking For
</div><div><ul><li>Experience in technology risk, IT audit, digital resilience, or related consulting.
</li></ul></div><div><ul><li>Working knowledge of UK/EU Technology and Resilience Regulations (including DORA) and frameworks such as COBIT, ITIL, NIST CSF, ISO 27001/22301.
</li></ul></div><div><ul><li>Practical experience in control testing or assurance fieldwork (evidence sampling, walkthroughs, KRI analysis).
</li></ul></div><div><ul><li>Strong communication skills - able to translate technical findings into clear, concise messages for business stakeholders.
</li></ul></div><div><ul><li>Familiarity with ServiceNow for resilience-related analysis and automation.
</li></ul></div><div><ul><li>Understanding of technology risk models and resilience frameworks.
</li></ul></div></div><div><div><ul><li>Demonstrable experience of using AI in current role for risk and resilience use cases.
</li></ul></div><div><ul><li>Progress toward professional certifications such as CRISC, CISA, CISSP, CBCI, ISO 22301 Lead Auditor, or Prince2/ AgilePM .
</li></ul></div><div><ul><li>Exposure to regulatory remediation programmes (e.g., s166 Skilled-Person reviews) preferred.
</li></ul></div></div>Education (if blank, degree and/or field of study not specified)
Degrees/Field of Study required:
Degrees/Field of Study preferred:
Certifications (if blank, certifications not specified)
Required Skills
Optional Skills
Accepting Feedback, Accepting Feedback, Active Listening, Amazon Web Services (AWS), Analytical Thinking, Apptio, Cloud Administration, Cloud-Based Service Management, Cloud Compliance, Cloud Engineering, Cloud Infrastructure, Cloud Infrastructure Architecture Design, Cloud Infrastructure Optimization, Cloud Migration, Cloud Operations (CloudOps), Cloud Performance Optimization, Cloud Service Delivery, Cloud Strategy, Communication, Creativity, CrowdStrike, Dynatrace APM, Embracing Change, Emotional Regulation, Empathy {+ 18 more}
Desired Languages (If blank, desired languages not specified)
Travel Requirements
Not Specified
Available for Work Visa Sponsorship?
No
Government Clearance Required?
No
Job Posting End Date</div>

ETIC, Technology and Resilience - Senior Associate

البنك التجاري الدولي

<div></div><div><div>Description<div></div> 
Job Purpose :

To support Technology &amp; Security Risk Management assessment activities, execute monitoring and reporting activities for Technology &amp; Security Risks, Technology &amp; Security Risk Management&rsquo;s Risk Appetite Indicators (RAIs) and Key Risk Indicators(KRIs) covering the six domains of Technology Risk Management (Cyber Security, Information Security, IT Resilience and Continuity, IT 3rd Party, IT Project Execution and Technology Control Assurance) to ensure adequacy and robustness of Risk&rsquo;s IMMMR (Identification, Measuring, Managing, Monitoring and Reporting).

Key Accountabilities:

1. Identify areas of improvement and formulate possible solutions that ensure robustness of Technology &amp; Security Risk Management Framework &amp; Policy as well as all associated policies and procedures related to the six domains of the Technology &amp; Security Risk Management as a governance activity in compliance with bank standards and regulations.

2. Actively contribute with relevant departments to identify risk gaps and early warning signals for Technology &amp; Security Risks that could arise from any change in systems, services, processes or procedures.

3. Actively contribute in defining, maintaining and enriching Technology &amp; Security Risk Managements&rsquo; Metrics, Taxonomy and Severity Scale as well as proficiently practice Technology &amp; Security Risk Management techniques, methods and tools that were designed to ensure that all technology &amp; security risks are adequately captured and managed. Moreover, prepare training materials and carry out communications activities in alignment with relevant stakeholders in order to improve mindset and knowledge.

4. Aggregate all Technology &amp; Security Risk Management&rsquo;s information and activities across First and Second Lines of Defense, assist in root cause analysis for risks and maintain a proper and updated Technology Risk Management&rsquo;s risk log including all residual and potential risks&rsquo; investigations and documentations to provide a standardized overview of technology risks.

5. Execute monitoring activities for technology risks. Design trend analysis for technology &amp; security risks and incident reporting as well as carryout and maintain Technology &amp; Security Risk management dashboards and KPIs to be directed regularly to relevant Risk or Technology Committees, Senior Management and the Board of Directors in order to drive more informed decisions.

6. Assist in reviewing the Risk Acceptance Forms (RAF) and Corrective Action Plan (CAP) related to Technology &amp; Security Risk Management in cooperation with IT, Security &amp; Resilience Management, Analytics &amp; Data Management areas prior submitting to NFRCC, to ensure effective response to identified technology &amp; security risks as well as ensure effective tracking for CAP progress, significant technology Risks&rsquo; status.
7. Assist and support the first line of defense in defining granular list of Technology &amp; Security Risk Management&rsquo;s KRIs/RAIs and regularly scan KRIs/RAIs for new requirements and consolidate them in a comprehensive view, to provide indication of the risk appetite and tolerance through metric setting (KRI threshold) and to ensure the effective alignment of Technology &amp; Security Risk Management strategy with the approved Risk &amp; Business Strategies.

8. Perform independent assessment on controls defined and executed by first line of defense provide support in controls&rsquo; development to ensure that they are in place and meet defined policies.

9. Define control testing plans and monitoring control testing results to ensure the effectiveness of controls in preventing or detecting Technology &amp; Security Risks.

10. Assist, support &amp; challenge from technical prospective the risk assessment activities, controls, mitigation plans and quality control activities implemented by first line of defense in Technology &amp; Security Risk and Control Self-Assessments (Technology -RCSAs) to ensure adequacy and robustness of Technology Risk&rsquo;s IMMMR.

11.Contribute in reviewing Technology &amp; Security Risk Management&rsquo;s memorandums submitted to BCOIT &amp; NFRCC committees to highlight potential technology risks and improve more informed decisions

Policies, Processes, and Procedures

Follow all relevant department policies, processes, and standards operating procedures and instructions so that work is carried out in an controlled and consistent manner.

Day-to-Day Operations

Follow the day-to-day operations related to own jobs in the Security &amp; Technology Risk Management department to ensure continuity of work
Compliance

Comply with all relevant CBE regulations, PCI Standards, banking laws, AML regulations and internal CIB policies and code of conduct in order to maintain CIB&rsquo;s sound legal position and mitigate any potential risks<div> 
</div></div><div>
Qualifications<div></div> 
Qualification &amp; Experience

&sect; Bachelor of Engineering, Computer Science, Information Technology or its equivalent.

&sect; For Officer 3 &ndash; 5 years in Risk Management, Information Technology or a related discipline.

&sect; For Senior Officer 5 &ndash; 8 years in Risk Management, Information Technology or a related discipline.

&sect; Good knowledge of the Bank&rsquo;s business environment, technology controls and Risk Management.

&sect; Recommended Certifications:
o IT Infrastructure Library (ITIL) Foundation.

o GIAC Information Security Fundamentals (GISF).

o GIAC Critical Controls Certification (GCCC).

o Certified Information Systems Security Professional (CISSP). 


Skills
&sect; Excellent command of English &amp; Arabic Languages

&sect; Self-motivated with high degree of reliability.

&sect; Sound understanding to Information security and Cyber Security practices.

&sect; Strong troubleshooting and Analytical skills.

&sect; Very good presentation, communication and time management skills.

&sect; Ability to work successfully in a cross-functional team environment.<div> 
</div></div><div>
Primary Location: Egypt-Giza-SMART VILLAGE BLDG. 2</div><div>
Job: Back Office</div><div>
Shift: Day Job</div><div>
Job Type: Full-time Employee</div><div>
Travel: No</div></div>

TECHNOLOGY RISK OFFICER/SENIOR OFFICER

American Express

<div>At American Express, our culture is built on a 175-year history of innovation, shared values and Leadership Behaviors, and an unwavering commitment to back our customers, communities, and colleagues. As part of Team Amex, you'll experience this powerful backing with comprehensive support for your holistic well-being and many opportunities to learn new skills, develop as a leader, and grow your career.
Here, your voice and ideas matter, your work makes an impact, and together, you will help us define the future of American Express.
How will you make an impact in this role?<div><div><div>
The Technology organization partners with the American Express business to enable, support, and drive the company&rsquo;s growth plans and strategic priorities by supporting the delivery and operations of technology capabilities, platforms, and services globally. Specifically, the team delivers global capabilities and services in support of American Express customers and colleagues, and it is responsible for the company&rsquo;s technology infrastructure, providing 24x7 support to ensure an uninterrupted, high-quality experience for external and internal customers. It also governs technology risk and information security across the American Express enterprise.
The objective of the Technology Control Management Issues, Events &amp; Remediation team is to ensure timely identification, response, and resolution of risk events and issues to minimize impact, as well as to prevent recurrence through effective remediation and lesson learning. 
Technology Control Management is looking for a Senior Associate of Issues, Events &amp; Remediation to focus on ensuring control management is embedded in the day-to-day operations of our organization. It will involve extensive collaboration with multiple partners across numerous business units, functional areas, and geographies.
The Senior Associate, Technology Control Management Issues, Events &amp; Remediation will:<ul><li>
Investigate and conduct root cause analysis while also addressing repeated issue types</li><li>
Scope, prioritize, and support remediation of issues by influencing BU, who own and execute issue/Operational Risk Event (ORE) remediation</li><li>
Oversee the remediation process, including tracking progress, validate resolution efficacy, and communicate status updates to stakeholders to embed accountability along the process, collaborating with other Operational Risk Management (ORM) / Control Management teams as necessary</li><li>
Perform quality assurance on documentation of issue/ORE type, urgency, severity/impact, impact analysis/impact estimates, and investigate as necessary to understand and address the root causes</li><li>
Document and maintain records of issues/OREs and remediations to ensure transparency and accountability in the issue management process</li><li>
Create documentation and gather supporting evidence for issue fixes and controls that are implemented.</li><li>
Analyze trends in issues and events to identify potential systemic risks or control weaknesses within BU processes</li><li>
Support and oversee the End-to-End (E2E) issue resolution process, embedding accountability and ensuring lessons learned are integrated into future ORM practices</li><li>
Opine on the effectiveness of control enhancements related to issues</li><li>
Engage with key stakeholders, including business unit leaders, compliance officers, and regulatory bodies, to facilitate effective issue management and resolution</li><li>
Prepare and present detailed reports on issue status, trends, and outcomes to senior management and governance committees</li><li>
Build cordial working relationship across stakeholders including Technology, Compliance, ECMU, ORGG and peer CM teams among others.</li></ul>
Required Qualifications:<ul><li>
5+ Years experience in operational risk management Understanding of critical operational risk management lifecycle activities</li><li>
Excellent project management, communication, and interpersonal skills, with an ability to interact and obtain buy-in from senior BU/tech counterparts</li><li>
Expertise in process governance, with a track record of establishing and overseeing robust decision-making processes that align with policies, regulatory frameworks, and/or operational standards</li><li>
Experience within financial services industry</li><li>
Strong analytical and problem-solving skills, with an ability to analyze data, identify trends, and evaluate risk scenarios effectively</li><li>
Demonstrate history and ability to manage teams, spread over geographies and with varying backgrounds</li><li>
Have executive presence and be able to provide status updates to senior leadership.</li></ul>
Preferred Qualifications:<ul><li>
Bachelor&rsquo;s degree in engineering and technology, Finance, Business, Risk Mgmt., or related field; advanced degrees (e.g., MBA, MSc) or certifications are advantageous</li><li>
Experience in at least one of the following:<ul><li>
Scoping, prioritizing, and support remediation of technology issues</li><li>
Investigating and conducting root cause analysis to address repeated operational risk issue types</li><li>
Performing quality assurance on documentation of operational risk issues and events</li><li>
Overseeing the remediation process for operational risk issues and events</li><li>
Documenting and maintaining records of operational risk issues and events to ensure transparency and accountability</li><li>
Supporting and overseeing the E2E issue resolution process, embedding accountability and ensuring lessons learned are integrated into future operational risk management practices</li><li>
Previous experience in a technical role.</li></ul></li></ul></div></div></div> 


We back you with benefits that support your holistic well-being so you can be and deliver your best. This means caring for you and your loved ones' physical, financial, and mental health, as well as providing the flexibility you need to thrive personally and professionally:<ul><li>
Competitive base salaries</li><li>
Bonus incentives</li><li>
Support for financial-well-being and retirement</li><li>
Comprehensive medical, dental, vision, life insurance, and disability benefits (depending on location)</li><li>
Flexible working model with hybrid, onsite or virtual arrangements depending on role and business need</li><li>
Generous paid parental leave policies (depending on your location)</li><li>
Free access to global on-site wellness centers staffed with nurses and doctors (depending on location)</li><li>
Free and confidential counseling support through our Healthy Minds program</li><li>
Career development and training opportunities</li></ul>
American Express is an equal opportunity employer and makes employment decisions without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran status, disability status, age, or any other status protected by law.
Offer of employment with American Express is conditioned upon the successful completion of a background verification check, subject to applicable laws and regulations.</div>

Senior Associate -Technology Risk & Control

Search 10000+ Technology risk analyst jobs near you this January. New roles added regularly across leading industries. Apply today.