Tech Risk & Controls Lead

Join our team to play a pivotal role in mitigating tech risks and upholding operational excellence, driving innovation in risk management.

As a Tech Risk & Controls Lead at JPMorgan Chase within the Commercial and Investment Bank, Blockchain Engineering Group - Kinexys business,  you will be responsible for identifying, and mitigating compliance and operational risks in line with the firm's standards. You will also provide subject matter expertise and technical guidance to technology-aligned process owners, ensuring that implemented controls are operating effectively and in compliance with regulatory, legal, and industry standards. By partnering with various stakeholders, including Product Owners, Business Control Managers, and Regulators, you will contribute to the reporting of a comprehensive view of technology risk posture and its impact on the business. You will support the Kinexys Technology Risk and Control (KTRAC) team in managing key risk and controls and facilitate interactions between cyber, operational risk and internal audit teams.  

Job Responsibilities:

• Works with KTRAC leads to execute the robust controls framework for the Kinexys technology organization.
• Partners with Cyber and application owners to execute on controls agenda inclusive risk assessments, controls testing and evidencing, identification of control gaps and building/tracking/closing action plans. 
• Collaborates with Tech/Operate SMEs to build processes, policies, procedures and programs to close control gaps identified during annual assessments and/or during BAU project development.
• Keeps abreast of regulatory changes and potential impact to controls environment. Thorough knowledge of GRC and key domains. Develop control procedures and ability to define controls
• Builds and maintains fundamental understanding of JPM Technology control standards. Develops and implement controls aligned to JPMC security standards
• Serves as tech point for tech assessment responses (inclusive of internal and 3rd party audits).
• Partners with 1/2/3 lines of defense and Tech SMEs to collect, track and disseminate artifacts and evidence requested by clients/customer/examiners/auditors
• Uses enterprise-authorized AI capabilities within the work environment to accelerate synthesis of risk/control evidence and draft executive-ready reporting, validating outputs and handling data according to sensitivity and security requirements
• Promotes reuse-first, AI-assisted approaches to streamline recurring control testing and issue/action-plan management routines, ensuring human review and alignment to auditability and regulatory expectations
• Assists in security gaps remediation activities as applicable. Collaborates with partners to provide written responses to regulatory requests.
• Develops and maintains tight audit and exam response tracking process. Provide timely and appropriate reporting to stakeholders

Required qualifications, capabilities, and skills

• 10 + years industry experience including Technology Risk and Controls assessment, support and management.
• Demonstrated solid understanding of technology fundamentals and evolving/emerging technologies inclusive of Information Security Architectures and Controls, CI/CD, SDLC, APIs, Cloud platforms, Distributed ledger Technologies (blockchain) and Architectures such as Blockchain, DevOps, Enterprise Production Operations.
• Experience with project management of risk assessment and audits. Experience in multiple cloud environment (AWS, Azure and Google)
• Experience using JIRA, Confluence and SharePoint collaboration tools. Experience and comfort working in an Agile environment. Strong familiarity with risk measurements and information security standards (E.g. NIST, ISO, SOC etc).
• Proven track record of initiating policy and control improvements and driving programs and that enhance transparency, governance or control.
• Excellent technical writing capability and oral executive-level communications skills. Ability to anticipate and understand complex regulator and stakeholder requirements.
• Demonstrable skill to tailor complex regulatory issues into effective messages.
• Highly-motivated, well-organized self-starter with exceptional judgment and strong analytical, advisory, communication, and project management skills.
• Strong team player with ability to work closely with multiple constituents. Ability to maintain sound judgement under pressure when faced with imperfect information.
• Demonstrated experience using enterprise-authorized AI capabilities within the work environment to support technology risk and controls workflows with strong validation habits and awareness of data sensitivity.
• Ability to review and validate AI-assisted risk summaries and recommendations before use, escalating when uncertain and ensuring outcomes align to security, auditability, and regulatory expectations.

Preferred qualifications, capabilities, and skills

• Certification: CISA, CRISC, CISSP, AWS or other security certification preferred