DIRECTOR, IT RISK MANAGEMENT

Job Overview

We are seeking a highly skilled and technical savvy Director of IT Risk to join our team. This individual will play a crucial role in managing and maturing our information technology risk assessment processes, focusing on cloud, on-premise, and vendor application and systems. The candidate will be responsible for ensuring the effectiveness of our IT controls, maintaining the risk register, managing exceptions to IT policies, and contributing to our DevSecOps initiatives from a risk perspective. The ideal candidate will have a strong expertise in SOC1 and SOC2 assessments, a solid understating of AWS cloud security and an interest in leveraging AI and Gen AI technologies to enhance risk management decision making and process automation.

Responsibilities:

• Implement policies related to IT risk management and manage the policy exception process

• Conduct Business Impact Analysis across Arrowstreet’s business systems and establish criticality across all systems for prioritization of IT risk management efforts

• Work closely with Cyber security team to ensure completeness and effectiveness of our IT controls to identify, respond and remediate threats

• Oversee third-party IT risk assessment and collaborate with business leaders to discuss and address identified weaknesses

• Manage and mature the incident management process to cover incident review, root cause analysis, and oversee implementation of mitigating controls

• Maintain Risk Register for visibility, transparency, and prioritization of IT Risks 

• Create, develop, and maintain operational risk documentation

• Play an active role in responding to Client diligence questionnaires

• Evolve the existing IT risk assessment process to succinctly frame emerging threats and risks

• Research and develop data-driven assessment practices that will facilitate deeper risk conversations and surface insights in support of strategic decision-making

Qualifications:

• Minimum 10 years of experience in Information Technology, Information Security or IT Risk Management

• Passion and expertise in technology and cybersecurity domains

• Excellent understanding of IT Controls and Risk Assessment methodologies including SOC1 and SOC2

• Certifications such as CISSP, SISM, CIRISC, and AWS Certified Security

• Experience implementing controls aligned to industry standard frameworks (NIST, ISO 27001)

• Ability to collaborate effectively with colleagues, stakeholders, and leaders across multiple departments to get consensus, socialize strategy, and achieve objectives

• Exceptional communication skills and the ability to build strong relationships as well as credibility

• Ability to manage and drive multiple parallel initiatives forward while maintaining superior results

• Strong analytical, problem-solving, and decision-making skills

Technical Plus:

• Hands-on experience with AWS and cloud security practices

• Software development or infrastructure implementation experience

• Familiarity with optimization of the processes via automation, AI/Gen AI implementations

We maintain a friendly, team-oriented environment and place a high value on professionalism, attitude and initiative.