Senior IT Risk Specialist

Company Federal Reserve Bank of San Francisco

• Partner with S+C colleagues to develop institution-specific risk assessments and supervisory strategies, including involvement in scoping and vetting processes, by providing subject matter expertise to influence and guide supervisory decision making.
• Lead efforts to identify and monitor emerging risks, issues, trends and developments, and to assess their impact on the banking industry and the SF Fed's supervisory program.
• Lead and participate in IT examinations of institutions with elevated IT/cybersecurity risk exposure.
• Collaborate on and lead cross-portfolio assessments of IT risk.
• Maintain a high level of subject matter expertise in cybersecurity/information security, cloud computing, IT operations, IT risk management, and IT internal audit, as well as supervisory expectations, industry practices, and emerging trends in those areas.
• Exhibit the expertise to assess business resiliency and third party (vendor) risk management from a cybersecurity perspective.
• Actively engage within District and System working groups to influence the development of IT focused supervision practices and programs. Liaise with Board of Governors and System risk experts regularly on emerging risks, risk management practices and changes in supervision policies, procedures, tools or guidance.
• Understand and communicate risk management expectations for IT infrastructures. Evaluate, interpret, and communicate governmental, industry, and other macro developments associated with IT and cybersecurity risk exposures.
• Prepare and deliver written analyses and presentations on firm specific as well as broader industry trends or emerging risks. Provide briefings to senior District and System staff and others in the supervisory community.
• Prepare informative, well-supported supervisory products and work papers, effectively communicating complex and problematic supervisory findings, including required actions to banks' senior management and boards of directors.
• Provide coaching, training, and mentoring to colleagues.
• Present to industry groups as part of outreach efforts.
• Consistently demonstrate the following critical behavioral competencies: collaboration, critical thinking, influence, and leadership.

• Bachelor's degree in business, economics, technology, or related fields of study (or equivalent work experience).
• Seven or more years of direct or comparable banking, financial industry or banking supervision experience with bank examinations, internal audit, or in conducting control assessments at a banking organization or consulting firm.
• Knowledge of and experience evaluating cybersecurity, information security and technology risks facing complex financial institutions and prudent practices for managing those risks, leveraging common frameworks, such as FFIEC, NIST, and ISO.
• Strong analytical and critical thinking skills demonstrated by the ability to assimilate new information, understand complex topics, and produce sound analysis.
• Excellent written and verbal communication skills and the ability to synthesize complex ideas and explain them clearly.
• Ability to think strategically, bringing a broad perspective on how to translate ideas into executable actions.
• Ability to thrive as a member of a team and to build collaborative working relationships with colleagues across teams and at different levels.
• Strong organizational skills, project management skills and attention to detail.
• Must be a U.S. Citizen, U.S. National, or hold a permanent resident/green card with intent to become a U.S. Citizen.
• Ability to travel up to 25 percent; however, the System will be conducting all supervisory activities offsite until personal safety due to COVID-19 is reasonably assured, and we are anticipating lower overall travel for supervisory activities following the pandemic.
• Effective October 1, 2021, all employees must be fully vaccinated against COVID-19 or qualify for an accommodation from the Bank's vaccination policy; the Bank will provide accommodations as required by law for individuals unable to be vaccinated due to medical condition or sincerely held religious belief.

• An active commission from a bank regulatory agency (e.g., Federal Reserve, FDIC, OCC).
• Professional designations, such as the CRISC, CISM, CISA, CISSP, and the CIA certifications.
• Experience performing IT examination work at community, regional, and/or large banking organizations.