Senior IT Risk Manager

The Senior IT Risk Manager reports to the Head of IT Risk Management (ITRM) within the firm's Operational Risk Management function. This function provides risk oversight for Voya’s Enterprise Information Technology (IT) function by facilitating processes to identify, monitor, and mitigate IT related operational risks. The mission of the Operational Risk Management (ORM) function is to support Voya Financial leadership in risk-based decision making and to assist with the management of operational risks of the enterprise.

We are seeking a Senior IT Risk Manager to join our dynamic and fast-paced team, where collaboration with IT stakeholders and senior leadership is paramount. This role involves comprehensive oversight of IT risks across all technology layers and processes, with a special emphasis on AI risk management. The successful candidate will employ business, IT, and operational process knowledge to perform independent review and challenge, and to advise stakeholders on solving complex and time-sensitive risk related matters.

Please Note:  Work location for this role is FLEXIBLE! This position allows 100% remote work from home or allows work to be performed in any of our major office locations with a hybrid schedule. 

The Contributions You'll Make:

• Forge Strong Partnerships: Actively engage with IT stakeholders and senior leadership to foster a robust risk culture. This includes regular interaction and collaboration at various organizational levels.
• AI Risk Management Expertise: Serve as a subject matter expert in AI risk management, playing a pivotal role in the identification, assessment, and mitigation of AI-related risks as well as maintenance and coordination of the AI risk governance program of work in line with risk principles and regulatory requirements.
• Real-Time Risk Advisory: Provide real-time risk advisory services, offering immediate guidance on IT risk scenarios and effective risk measurement strategies.
• Risk and Control Framework: Define and maintain IT risk and control standards, ensuring a comprehensive and up-to-date framework is in place.
• Risk Identification and Assessment: Lead comprehensive IT risk identification and assessment processes, including IT process reviews, top-down risk assessments, targeted risk and control assessments, and the development of Key Risk Indicators (KRIs).
• Incident Analysis and Optimization: Monitor and analyze incidents within IT environment to identify opportunities for process improvement, control optimization, and risk reduction.
• Risk Reporting: Develop and refine risk reporting mechanisms and materials for risk committees and senior management.
• Regulatory Compliance: Assist in ensuring IT compliance with all relevant laws and regulations, providing assessments and recommendations.
• Business Impact Analysis: Collaborate with line of business Operational Risk Management (ORM) teams to evaluate potential IT risks and trends, assessing their impact on business operations and communicating their significance to stakeholders.
• Strategic Development: Contribute to the ongoing development and maintenance of the IT Risk Management strategy and framework, including the education of stakeholders on risk-related matters.
• Travel: Infrequent travel to Voya office locations for collaboration purposes may be required.  

Minimum Knowledge and Experience:

·         Bachelor’s degree in Computer Science, MIS or related field; or equivalent work experience. Master’s degree desired.

·         8-10 years of relevant experience, including minimum 4 years of financial services experience, with a strong background in IT, IT audit, and/or IT risk.

·         Proven experience in IT risk management, with a strong emphasis on AI risk management.

·         CISA, CISSP, CISM, CRISC or other related IT or AI risk certification is preferred including cloud platform certifications.

·         In-depth knowledge of IT standards and regulatory frameworks such as NIST, COBIT, ITIL, and ISO27000.

·         Ability to simplify complex IT risks for non-technical stakeholders, ensuring comprehensive understanding and decision-making.

·         Ability to discern and measure business relevant risk from IT risks and issues, and to identify cost effective remediation options.

·         Excellent communication skills, with the ability to articulate complex risk scenarios to diverse audiences.

·         Strong analytical and problem-solving abilities.

·         Proven ability to operate independently and thrive in a dynamic, fast-paced setting.

·         Proficient in the Microsoft Office suite and adept at using automated reporting tools to create executive-level documentation.