Search Jobs | Dice.com

Job Details

Skills

Collaboration
Decision-making
Quality Assurance
Test Plans
Data Management
Sustainability
ROOT
Training
Organizational Skills
Management Reporting
Brand
Internal Control
Auditing
Internal Auditing
Regulatory Affairs
Evaluation
Risk Assessment
Test Methods
Higher Education
FOCUS
NIST 800-53
IT Security
Firewall
Active Directory
LDAP
SAML
Management
Information Technology
Computer Science
Law
Business Administration
CISA
Authorization
CISSP
CISM
Information Security
ISACA
Information Systems
NIST SP 800 Series
COBIT
ISO 9000
Risk Management
Project Management
Encryption
Cloud Computing
Network Security
Access Control
Software Security
Cyber Security
Security Controls
IT Audit
Testing

Collaboration
Decision-making
Quality Assurance
Test Plans
Data Management
Sustainability
ROOT
Training
Organizational Skills
Management Reporting
Brand
Internal Control
Auditing
Internal Auditing
Regulatory Affairs
Evaluation
Risk Assessment
Test Methods
Higher Education
FOCUS
NIST 800-53
IT Security
Firewall
Active Directory
LDAP
SAML
Management
Information Technology
Computer Science
Law
Business Administration
CISA
Authorization
CISSP
CISM
Information Security
ISACA
Information Systems
NIST SP 800 Series
COBIT
ISO 9000
Risk Management
Project Management
Encryption
Cloud Computing
Network Security
Access Control
Software Security
Cyber Security
Security Controls
IT Audit
Testing

Summary

This role offers a hybrid work schedule; offering the flexibility to work remotely one day a week, while providing the opportunity for in-person collaboration. Sponsorship is NOT available for this position.

Overview:

Executes and manages independent control testing and remediation plan closure validation activities across Technology, Cybersecurity, and Data domains. Influences risk management outcomes by partnering with Risk Advisors and Risk Owners on risk identification, control coverage, and control design adequacy. Provides subject matter expertise for complex testing and validation activities, reviews the work of peers, supports development and maintenance of the annual testing plan, and prepares management reporting to enable effective risk-based decision making.

Primary Responsibilities:

Maintain the Controls Testing methodology, procedures, standards, and quality assurance practices to ensure testing activities are executed consistently and in accordance with internal policies and requirements.
Lead the development, execution, and management of the Annual Controls Testing Plan utilizing risk-based principles, inherent risk assessments, regulatory expectations, emerging risks, and organizational priorities to ensure appropriate testing coverage across Technology, Cybersecurity, and Data risk domains.
Direct and execute independent assessments of control design and operating effectiveness to determine whether controls are appropriately designed and operating effectively to mitigate identified risks and maintain residual risk within approved risk appetite.
Provide effective challenge to Risk Advisors, Risk Owners, Control Owners, and Process Owners regarding risk identification, risk-to-control mappings, control coverage, control rationalization, testing scope, and control design adequacy.
Lead complex controls testing engagements and issue evaluations involving high-risk technologies, cybersecurity processes, data management capabilities, regulatory commitments, and strategic initiatives.
Evaluate the sustainability and effectiveness of remediation activities to independently confirm whether corrective actions effectively address identified root causes, design deficiencies, operating effectiveness failures, audit findings, regulatory issues, and self-identified issues.
Contribute to design and delivery of training programs to ensure comprehensive knowledge of technology and cybersecurity risk management and growing critical skills to enhance team's outcomes.
Coordinate preparation and response to regulatory engagements, including reviewing responses for accuracy and meeting regulatory request, organizing documents and packets, and leading exam management (i.e., template folders, review of first day letter and follow-up requests).
Prepare and deliver management reporting on testing results, thematic observations, control environment maturity, remediation status, and emerging risk trends.
Understand and adhere to the Company's risk and regulatory standards, policies and controls in accordance with the Company's Risk Appetite. Identify risk-related issues needing escalation to management.
Promote an environment that supports diversity and reflects the M&T Bank brand.
Maintain M&T internal control standards, including timely implementation of internal and external audit points together with any issues raised by external regulators as applicable.
Complete other related duties as assigned.

Scope of Responsibilities:

This role primarily interacts with senior people leaders within the Technology and Cybersecurity teams, senior people leaders of Technology and Cybersecurity Risk, and internal partners such as the Risk Division, Internal Audit, and Regulatory Affairs.
Work is accomplished with periodic direction. The position exercises judgement in selecting methods, techniques, and evaluation criteria in obtaining results. It exerts significant latitude in determining objective of assignment and takes calculated risks with consultation from expert.
Apply professional judgment in determining testing strategies, sample selection approaches, issue severity assessments, remediation validation requirements, and conclusions regarding control effectiveness and risk mitigation.
Review and challenges complex risk assessments to provide an independent opinion on the completeness of risk identification, appropriateness of control selection, and adequacy of control design
Serves as a recognized subject matter expert for controls testing methodology, control design assessment, operating effectiveness testing, issue validation, remediation validation, and risk-based assurance practices.
This role may present to Regulators under direction of senior Technology and Cybersecurity Risk leaders.

Education and Experience Required:

Bachelor's degree and a minimum of 7 years' relevant work experience, or in lieu of a degree, a combined minimum of 11 years' higher education and/or work experience
Demonstrated expert knowledge of Technology and/or Cybersecurity risk principles
Minimum of 6 years' relevant work experience in or with the specific Technology, Cybersecurity risk area and/or business unit
Previous experience of NIST (National Institute of Standards and Technology) or Cybersecurity frameworks, with a strong focus NIST 800-53 and 800-53a
Strong knowledge of cybersecurity principles and industry best practices (relevant to confidentiality, integrity, availability)
Proven knowledge of information technology security principles and implementation methods (e.g., firewalls, demilitarized zones, encryption, Active Directory / LDAP, SAML)
Skilled in evaluating security controls based on confidentiality, integrity and availability requirements of systems
Experience with handling multiple projects
Experience meeting strict deadlines
Experience overseeing project tasks for less experienced team members

Education and Experience Preferred:

Master's degree in Information Technology, Computer Science, Cybersecurity, Law, Business Administration, or related field
Active CISA (Certified Information Systems Auditor), CAP (Certified Authorization Professional), CISSP (Certified Information Systems Security Professional), CISM (Certified Information Security Manager), or CRISC (Certified in Risk and Information Systems Control) certification or Cybersecurity domain-related industry-recognized certification
Working knowledge of the current version of the NIST SP800-53 and 800-53a Controls, or other recognized control frameworks, such as COBIT (Control Objectives for Information and Related Technology) or ISO
Knowledge of organization's risk tolerance and/or risk management approach
Working knowledge of project management methodology
Strong and proven knowledge of security technologies and architecture, including encryption, cloud network security design, role-based access control, perimeter security and application security
Knowledge of Cybersecurity threats and emerging security issues
Experienced in conducting security control testing of systems
IT Audit and/or First Line Control testing experience

#LI-JB3

M&T Bank is committed to fair, competitive, and market-informed pay for our employees. The pay range for this position is $123,600.00 - $206,000.00 Annual (USD). The successful candidate's particular combination of knowledge, skills, and experience will inform their specific compensation.

Location
Buffalo, New York, United States of America

Employers have access to artificial intelligence language tools (“AI”) that help generate and enhance job descriptions and AI may have been used to create this description. The position description has been reviewed for accuracy and Dice believes it to correctly reflect the job opportunity.

Dice Id: 80180520
Position Id: 7c62e0fc1cc429880045933ee7f887b
Posted 27 days ago

Job Details

Skills

Collaboration
Decision-making
Quality Assurance
Test Plans
Data Management
Sustainability
ROOT
Training
Organizational Skills
Management Reporting
Brand
Internal Control
Auditing
Internal Auditing
Regulatory Affairs
Evaluation
Risk Assessment
Test Methods
Higher Education
FOCUS
NIST 800-53
IT Security
Firewall
Active Directory
LDAP
SAML
Management
Information Technology
Computer Science
Law
Business Administration
CISA
Authorization
CISSP
CISM
Information Security
ISACA
Information Systems
NIST SP 800 Series
COBIT
ISO 9000
Risk Management
Project Management
Encryption
Cloud Computing
Network Security
Access Control
Software Security
Cyber Security
Security Controls
IT Audit
Testing

Collaboration
Decision-making
Quality Assurance
Test Plans
Data Management
Sustainability
ROOT
Training
Organizational Skills
Management Reporting
Brand
Internal Control
Auditing
Internal Auditing
Regulatory Affairs
Evaluation
Risk Assessment
Test Methods
Higher Education
FOCUS
NIST 800-53
IT Security
Firewall
Active Directory
LDAP
SAML
Management
Information Technology
Computer Science
Law
Business Administration
CISA
Authorization
CISSP
CISM
Information Security
ISACA
Information Systems
NIST SP 800 Series
COBIT
ISO 9000
Risk Management
Project Management
Encryption
Cloud Computing
Network Security
Access Control
Software Security
Cyber Security
Security Controls
IT Audit
Testing

Summary

Maintain the Controls Testing methodology, procedures, standards, and quality assurance practices to ensure testing activities are executed consistently and in accordance with internal policies and requirements.
Lead the development, execution, and management of the Annual Controls Testing Plan utilizing risk-based principles, inherent risk assessments, regulatory expectations, emerging risks, and organizational priorities to ensure appropriate testing coverage across Technology, Cybersecurity, and Data risk domains.
Direct and execute independent assessments of control design and operating effectiveness to determine whether controls are appropriately designed and operating effectively to mitigate identified risks and maintain residual risk within approved risk appetite.
Provide effective challenge to Risk Advisors, Risk Owners, Control Owners, and Process Owners regarding risk identification, risk-to-control mappings, control coverage, control rationalization, testing scope, and control design adequacy.
Lead complex controls testing engagements and issue evaluations involving high-risk technologies, cybersecurity processes, data management capabilities, regulatory commitments, and strategic initiatives.
Evaluate the sustainability and effectiveness of remediation activities to independently confirm whether corrective actions effectively address identified root causes, design deficiencies, operating effectiveness failures, audit findings, regulatory issues, and self-identified issues.
Contribute to design and delivery of training programs to ensure comprehensive knowledge of technology and cybersecurity risk management and growing critical skills to enhance team's outcomes.
Coordinate preparation and response to regulatory engagements, including reviewing responses for accuracy and meeting regulatory request, organizing documents and packets, and leading exam management (i.e., template folders, review of first day letter and follow-up requests).
Prepare and deliver management reporting on testing results, thematic observations, control environment maturity, remediation status, and emerging risk trends.
Understand and adhere to the Company's risk and regulatory standards, policies and controls in accordance with the Company's Risk Appetite. Identify risk-related issues needing escalation to management.
Promote an environment that supports diversity and reflects the M&T Bank brand.
Maintain M&T internal control standards, including timely implementation of internal and external audit points together with any issues raised by external regulators as applicable.
Complete other related duties as assigned.

Scope of Responsibilities:

This role primarily interacts with senior people leaders within the Technology and Cybersecurity teams, senior people leaders of Technology and Cybersecurity Risk, and internal partners such as the Risk Division, Internal Audit, and Regulatory Affairs.
Work is accomplished with periodic direction. The position exercises judgement in selecting methods, techniques, and evaluation criteria in obtaining results. It exerts significant latitude in determining objective of assignment and takes calculated risks with consultation from expert.
Apply professional judgment in determining testing strategies, sample selection approaches, issue severity assessments, remediation validation requirements, and conclusions regarding control effectiveness and risk mitigation.
Review and challenges complex risk assessments to provide an independent opinion on the completeness of risk identification, appropriateness of control selection, and adequacy of control design
Serves as a recognized subject matter expert for controls testing methodology, control design assessment, operating effectiveness testing, issue validation, remediation validation, and risk-based assurance practices.
This role may present to Regulators under direction of senior Technology and Cybersecurity Risk leaders.

Education and Experience Required:

Bachelor's degree and a minimum of 7 years' relevant work experience, or in lieu of a degree, a combined minimum of 11 years' higher education and/or work experience
Demonstrated expert knowledge of Technology and/or Cybersecurity risk principles
Minimum of 6 years' relevant work experience in or with the specific Technology, Cybersecurity risk area and/or business unit
Previous experience of NIST (National Institute of Standards and Technology) or Cybersecurity frameworks, with a strong focus NIST 800-53 and 800-53a
Strong knowledge of cybersecurity principles and industry best practices (relevant to confidentiality, integrity, availability)
Proven knowledge of information technology security principles and implementation methods (e.g., firewalls, demilitarized zones, encryption, Active Directory / LDAP, SAML)
Skilled in evaluating security controls based on confidentiality, integrity and availability requirements of systems
Experience with handling multiple projects
Experience meeting strict deadlines
Experience overseeing project tasks for less experienced team members

Education and Experience Preferred:

Master's degree in Information Technology, Computer Science, Cybersecurity, Law, Business Administration, or related field
Active CISA (Certified Information Systems Auditor), CAP (Certified Authorization Professional), CISSP (Certified Information Systems Security Professional), CISM (Certified Information Security Manager), or CRISC (Certified in Risk and Information Systems Control) certification or Cybersecurity domain-related industry-recognized certification
Working knowledge of the current version of the NIST SP800-53 and 800-53a Controls, or other recognized control frameworks, such as COBIT (Control Objectives for Information and Related Technology) or ISO
Knowledge of organization's risk tolerance and/or risk management approach
Working knowledge of project management methodology
Strong and proven knowledge of security technologies and architecture, including encryption, cloud network security design, role-based access control, perimeter security and application security
Knowledge of Cybersecurity threats and emerging security issues
Experienced in conducting security control testing of systems
IT Audit and/or First Line Control testing experience

Dice Id: 80180520
Position Id: 7c62e0fc1cc429880045933ee7f887b
Posted 27 days ago

Senior Security Control Assessor

Remote

•

2d ago

Senior Security Control Assessor Remote Blu Omega is seeking a Senior Security Control Assessor to support the FDIC security and privacy program. This role is responsible for conducting comprehensive assessments of IT systems' security/privacy controls in accordance with the NIST Risk Management Framework (RMF). Program Overview: Blu Omega supports federal agencies in safeguarding critical information systems through security and privacy assessments aligned with federal standards. Key Details: L

Easy Apply

Contract

Depends on Experience

Senior Technology and Cybersecurity Risk & Controls Specialist

Skills

Summary

Dice Job Match Score™

Similar Jobs

Senior Technology and Cybersecurity Risk & Controls Specialist

Job Details

Skills

Summary

Dice Job Match Score™

Similar Jobs