Role Overview
The Risk & Compliance Project Manager and Application Manager is a dual-mandate leadership role designed to oversee the end-to-end lifecycle, stability, and evolution of critical enterprise risk, regulatory, and compliance software applications, while concurrently driving large-scale regulatory and compliance technology initiatives. This hybrid position bridges business risk units, compliance officers, information security teams, internal/external auditors, and core IT engineering groups. The incumbent ensures that business-critical compliance applications operate reliably, securely, and in full alignment with evolving domestic and global regulatory standards (e.g., SOX, GDPR, GLBA, DORA, Basel/FRTB, AML/KYC), while managing multi-stream technical projects from inception through delivery. Key Responsibilities
Part A: Application Management & Operational Governance
Lifecycle & Operational Ownership: Own the operational health, support frameworks, SLA adherence, and ongoing lifecycle of GRC (Governance, Risk, and Compliance), RegTech, and audit platforms. Application Availability & Resiliency: Oversee system performance, disaster recovery planning, business continuity (BCP/DR), and observability for mission-critical risk data pipelines and reporting engines. Release & Change Management: Govern change control boards (CCB) and application release schedules, ensuring all configuration changes, patches, and version upgrades maintain strict auditability and minimal operational downtime. Incident & Problem Management: Act as technical escalation lead for high-severity incidents, orchestrating rapid resolution, root-cause analysis (RCA), and preventative control remediation. Access Governance & Data Protection: Enforce least-privilege role-based access control (RBAC), segregation of duties (SoD), and sensitive data encryption across all managed compliance systems.
Part B: Risk, Compliance & Regulatory Assurance
Regulatory Interpretation & Alignment: Translate new regulatory mandates, industry frameworks, and supervisory guidance into actionable application architecture requirements and project roadmaps. Audit & Exam Management: Serve as the primary technical interface for internal audit teams, external regulatory bodies, and third-party risk assessors; ensure timely delivery of evidentiary artifacts and control testing data. Issue Tracking & Remediation (CAPs/MRAs): Manage the identification, tracking, and technical remediation of audit findings, corrective action plans (CAPs), Matters Requiring Attention (MRAs), and vulnerability assessments. Continuous Control Monitoring: Design and maintain automated key risk indicators (KRIs) and key control indicators (KCIs) embedded within application workflows.
Part C: Project & Program Management
End-to-End Project Delivery: Lead complex regulatory technology and compliance integration initiatives from scoping, business case formulation, and milestone tracking to deployment and operational handover. Methodology & Governance: Apply Agile, Waterfall, or hybrid project management methodologies to coordinate cross-functional sprints, release gates, and steering committee cadences. Scope, Budget & Resource Management: Manage project schedules, resource allocations, dependency risks, and financial budgets (CapEx/OpEx). Executive Reporting & Stakeholder Alignment: Deliver comprehensive project scorecards, risk burndown charts, and executive status dashboards to Chief Risk Officers (CRO), Chief Compliance Officers (CCO), and IT leadership.
Part D: Vendor & Third-Party Risk Management
Vendor Oversight: Oversee relationships with GRC/RegTech software vendors and implementation partners, monitoring performance against contractual SLAs and statements of work (SOWs). Third-Party Risk Assessment (TPRM): Conduct ongoing third-party technology risk assessments, SOC report reviews, and security posture evaluations for vendor-hosted applications.
Required Qualifications & Experience
Professional Experience
6-8+ years of progressive experience spanning IT application management, technology project management, and technology risk/compliance governance within regulated environments (e.g., Financial Services, Banking, Healthcare, or FinTech). Proven track record of managing enterprise GRC/RegTech platforms (e.g., ServiceNow IRM/GRC, Archer, MetricStream, OneTrust, Actimize, or proprietary risk calculation engines). Demonstrated experience delivering high-stakes regulatory technology projects, managing regulatory examinations, and resolving audit findings.
Technical & Domain Competencies
Regulatory Frameworks: Strong working knowledge of major regulatory standards and control frameworks (e.g., NIST CSF, ISO 27001, SOX 404, SOC 1/2, GDPR, DORA, FFIEC, PCI-DSS). Project & Service Methodologies: Proficiency in Agile (Scrum/Kanban), Waterfall, and ITIL Service Management frameworks (Change, Incident, Problem, Release). Technology Stack Awareness: Solid understanding of enterprise soft
#J-18808-Ljbffr
Risk & Compliance Project Manager and Application Manager employer: Citigroup
Citi is an exceptional employer that fosters a culture of innovation and collaboration, making it an ideal place for Senior Engineers in Java and AI. With a commitment to employee growth, Citi offers extensive training programs and opportunities to work on cutting-edge technologies, all while enjoying a dynamic work environment in a vibrant city. Join us to be part of a team that values your contributions and supports your professional journey.
