Role Overview
The Risk & Compliance Project Manager and Application Manager is a dual-mandate leadership role designed to oversee the end-to-end lifecycle, stability, and evolution of critical enterprise risk, regulatory, and compliance software applications, while concurrently driving large-scale regulatory and compliance technology initiatives.
This hybrid position bridges business risk units, compliance officers, information security teams, internal/external auditors, and core IT engineering groups. The incumbent ensures that business-critical compliance applications operate reliably, securely, and in full alignment with evolving domestic and global regulatory standards (e.g., SOX, GDPR, GLBA, DORA, Basel/FRTB, AML/KYC), while managing multi-stream technical projects from inception through delivery.
Key Responsibilities
Part A: Application Management & Operational Governance
- Lifecycle & Operational Ownership: Own the operational health, support frameworks, SLA adherence, and ongoing lifecycle of GRC (Governance, Risk, and Compliance), RegTech, and audit platforms.
- Application Availability & Resiliency: Oversee system performance, disaster recovery planning, business continuity (BCP/DR), and observability for mission-critical risk data pipelines and reporting engines.
- Release & Change Management: Govern change control boards (CCB) and application release schedules, ensuring all configuration changes, patches, and version upgrades maintain strict auditability and minimal operational downtime.
- Incident & Problem Management: Act as technical escalation lead for high-severity incidents, orchestrating rapid resolution, root-cause analysis (RCA), and preventative control remediation.
- Access Governance & Data Protection: Enforce least-privilege role-based access control (RBAC), segregation of duties (SoD), and sensitive data encryption across all managed compliance systems.
Part B: Risk, Compliance & Regulatory Assurance
- Regulatory Interpretation & Alignment: Translate new regulatory mandates, industry frameworks, and supervisory guidance into actionable application architecture requirements and project roadmaps.
- Audit & Exam Management: Serve as the primary technical interface for internal audit teams, external regulatory bodies, and third-party risk assessors; ensure timely delivery of evidentiary artifacts and control testing data.
- Issue Tracking & Remediation (CAPs/MRAs): Manage the identification, tracking, and technical remediation of audit findings, corrective action plans (CAPs), Matters Requiring Attention (MRAs), and vulnerability assessments.
- Continuous Control Monitoring: Design and maintain automated key risk indicators (KRIs) and key control indicators (KCIs) embedded within application workflows.
Part C: Project & Program Management
- End-to-End Project Delivery: Lead complex regulatory technology and compliance integration initiatives from scoping, business case formulation, and milestone tracking to deployment and operational handover.
- Methodology & Governance: Apply Agile, Waterfall, or hybrid project management methodologies to coordinate cross-functional sprints, release gates, and steering committee cadences.
- Scope, Budget & Resource Management: Manage project schedules, resource allocations, dependency risks, and financial budgets (CapEx/OpEx).
- Executive Reporting & Stakeholder Alignment: Deliver comprehensive project scorecards, risk burndown charts, and executive status dashboards to Chief Risk Officers (CRO), Chief Compliance Officers (CCO), and IT leadership.
Part D: Vendor & Third-Party Risk Management
- Vendor Oversight: Oversee relationships with GRC/RegTech software vendors and implementation partners, monitoring performance against contractual SLAs and statements of work (SOWs).
- Third-Party Risk Assessment (TPRM): Conduct ongoing third-party technology risk assessments, SOC report reviews, and security posture evaluations for vendor-hosted applications.
Required Qualifications & Experience
Professional Experience
- 6–8+ years of progressive experience spanning IT application management, technology project management, and technology risk/compliance governance within regulated environments (e.g., Financial Services, Banking, Healthcare, or FinTech).
- Proven track record of managing enterprise GRC/RegTech platforms (e.g., ServiceNow IRM/GRC, Archer, MetricStream, OneTrust, Actimize, or proprietary risk calculation engines).
- Demonstrated experience delivering high-stakes regulatory technology projects, managing regulatory examinations, and resolving audit findings.
Technical & Domain Competencies
- Regulatory Frameworks: Strong working knowledge of major regulatory standards and control frameworks (e.g., NIST CSF, ISO 27001, SOX 404, SOC 1/2, GDPR, DORA, FFIEC, PCI-DSS).
- Project & Service Methodologies: Proficiency in Agile (Scrum/Kanban), Waterfall, and ITIL Service Management frameworks (Change, Incident, Problem, Release).
- Technology Stack Awareness: Solid understanding of enterprise software architectures, relational/non-relational databases (SQL), API integrations, ETL/data pipelines, and cloud computing environments (AWS/Azure/GCP).
- Tools & Platforms: Hands-on experience with project management and collaboration platforms (Jira, Confluence, MS Project, Smartsheet) and monitoring tools (Splunk, Datadog).
Leadership & Soft Skills
- Exceptional stakeholder management skills, capable of bridging technical engineering discussions and executive legal/compliance expectations.
- Proven negotiation and influence skills with internal business leaders and external regulatory examiners.
- Strong analytical and problem-solving mindset with high attention to precision and evidentiary detail.
Preferred Certifications
Candidates holding a combination of project management, risk governance, and IT service certifications will be given strong preference:
- Risk & Compliance: CRISC (Certified in Risk and Information Systems Control), CISA (Certified Information Systems Auditor), CISM (Certified Information Security Manager), or CRMA (Certification in Risk Management Assurance).
- Project Management: PMP (Project Management Professional), PMI-ACP, Certified ScrumMaster (CSM), or SAFe Program Consultant / Agilist.
- IT Service & Architecture: ITIL v4 Foundation / Managing Professional, TOGAF, or Cloud Fundamentals Certification (AWS/Azure).
Education
- Bachelor’s degree in Computer Science, Information Systems, Cyber/Information Security, Finance, Risk Management, or related field (Master’s degree or MBA preferred).
------------------------------------------------------
Job Family Group: Technology------------------------------------------------------
Job Family:Applications Development------------------------------------------------------
Time Type:Full time------------------------------------------------------
Primary Location Full Time Salary Range:$145,100.00 - $217,700.00------------------------------------------------------
Most Relevant Skills Please see the requirements listed above.------------------------------------------------------
Other Relevant Skills For complementary skills, please see above and/or contact the recruiter.------------------------------------------------------
Automated Processing and AIWe use automated processing, including artificial intelligence, for our legitimate business interests (or our reasonable and appropriate business purposes) to identify and align the candidate's skills and abilities with a specific job opening. Additionally, if you so choose, or consent, we can match your skills and abilities to other suitable roles at Citi.
Importantly, all our hiring processes and decisions, including determining your suitability for a role, are conducted, checked, and decided by individuals. Our automated processing and AI do not involve relying on automatic or autonomous decision-making. Please refer to any Jurisdictional Considerations, with specific provisions for your country (where relevant) for further details.
------------------------------------------------------
This job opening is for an existing job vacancy.
------------------------------------------------------
Citi is an equal opportunity employer, and qualified candidates will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other characteristic protected by law.
If you are a person with a disability and need a reasonable accommodation to use our search tools and/or apply for a career opportunity review Accessibility at Citi.
View Citi’s EEO Policy Statement and the Know Your Rights poster.
Skills Required
- 6–8+ years of experience spanning IT application management, technology project management, and technology risk or compliance governance
- Experience working within regulated environments such as financial services, banking, healthcare, or FinTech
- Experience managing enterprise GRC or RegTech platforms, such as ServiceNow IRM/GRC, Archer, MetricStream, OneTrust, or Actimize
- Experience delivering regulatory technology projects, managing regulatory examinations, and resolving audit findings
- Knowledge of NIST CSF, ISO 27001, SOX 404, SOC 1/2, GDPR, DORA, FFIEC, and PCI-DSS
- Proficiency with Agile, Scrum/Kanban, Waterfall, and ITIL Service Management frameworks
- Understanding of enterprise software architecture, SQL databases, API integrations, ETL/data pipelines, and cloud environments
- Experience with Jira, Confluence, MS Project, Smartsheet, Splunk, and Datadog
- Bachelor’s degree in Computer Science, Information Systems, Cyber or Information Security, Finance, Risk Management, or a related field
- Strong stakeholder management, negotiation, analytical, problem-solving, and evidentiary-detail skills
- Master’s degree or MBA
- CRISC, CISA, CISM, or CRMA certification
- PMP, PMI-ACP, Certified ScrumMaster, or SAFe certification
- ITIL v4, TOGAF, or AWS/Azure cloud fundamentals certification
Citi Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about Citi and has not been reviewed or approved by Citi.
-
Healthcare Strength — Health coverage is presented as comprehensive, including free in-network preventive care, mental-health resources, and the Be Well Program. Materials also state new hires have access to health and insurance benefits from the outset.
-
Retirement Support — The retirement plan offers a $1-for-$1 match up to 6% of eligible pay. New employees are eligible for the plan, with automatic enrollment after 90 days if they do not enroll themselves.
-
Inclusive Benefits Coverage — Benefits highlight fertility treatment coverage, adoption/surrogacy reimbursement up to $30,000, and disability coverage. Coverage extends to spouses and domestic partners regardless of gender identity or sexuality, with gender-affirming care-related support noted.
Citi Insights
What We Do
Citi's mission is to serve as a trusted partner to our clients by responsibly providing financial services that enable growth and economic progress. Our core activities are safeguarding assets, lending money, making payments and accessing the capital markets on behalf of our clients. We have 200 years of experience helping our clients meet the world's toughest challenges and embrace its greatest opportunities. We are Citi, the global bank – an institution connecting millions of people across hundreds of countries and cities.
