DIRECTOR, DEVELOPER EXPERIENCE (DEVEX) TECHNOLOGY AND PRODUCT RISK GUIDE
Company: Capital One
Location: New York
Posted on: October 24, 2024
Job Description:
Center 3 (19075), United States of America, McLean,
VirginiaDirector, Developer Experience (DevEx) Technology and
Product Risk GuideAs a Technology Risk Director in Capital One's
Tech and Product Risk Office, you will apply your risk management,
cyber, and technical expertise to the company's Technology
organization. You will partner across Enterprise Services,
Divisional CIOs, and Information Security teams to develop and
support best-in-class industry risk solutions in a manner that
supports innovation and protects our customers, shareholders, and
associates. You will collaborate with second lines of defense to
lead and implement risk and control tools, techniques, and
frameworks for the Technology organization, as well as provide
direct tech risk advisory services into our first line Tech
organization supporting our continuous integration and continuous
delivery (CI/CD) ecosystem, DevOps processes, and SDLC framework.
Your contributions will drive organizational - and strategic change
through risk identification, measurement, analysis, and reporting
in order to better manage the company's risk in an open and
collaborative environment.Technology Risk Directors are experienced
and progressive individuals that operate within a highly
collaborative team environment to deliver value-added risk
management services to our Technology savvy business partners. You
will have a high level of exposure across lines of business and
have the opportunity to work with senior Technology Executives to
create and implement innovative solutions to identify and mitigate
potential risks to the Company. Proficiency in risk management
program (ideally Technology risk-driven program) development and
management are key to success in this role. The successful
candidate will be an experienced risk management professional who
understands cyber technology functions and organizations, with
strong analytical, planning, strategic thinking, organizational,
and communication skills.Responsibilities:
- Serve as the Technology Risk Guide leader for the Developer
Experience Technology and Product Leadership Team and respective
software engineering teams to propel technology risk agenda and
help them make informed risk-based decisions.
- Assist Tech and Product Risk leadership in delivering against
their strategy and services
- Provide oversight and guidance on key strategic Technology
initiatives with a focus on initiatives to enhance CI/CD and SDLC
practices (e.g., release decisioning policies, automated testing,
etc.)
- Serve as interdepartmental advisor, interfacing with technology
lines of business and other areas such as second line Technology
and Cyber organizations and Compliance; collaborate effectively
across multiple organizations to achieve objectives
- Identify and implement continual program enhancements based on
industry standards and best practices related to risk management
(especially technology risk) and aligned with Capital One's
strategic risk direction
- Gather risk and control data and reporting; perform initial
analysis or potentially evaluate data provided by team
analysts
- Design and implement internal risk and control governance
processes
- Build successful relationships with DevEx tech and product,
cyber and the developer community to understand the impact of
technology risk on development and release practices.
- Influence leaders within DevEx, Cyber, second line risk
organizations, the developer community, and Internal Audit on key
technology risks and actions needed
- Develop and monitor risk analysis, perform deep dive
investigations, and drive specific risk initiatives to minimize
risk posture and strengthen overall control suite
effectiveness
- Support Risk Control and Self Assessments (RCSAs)
- Understand, document, and analyze current state capabilities
leveraging one or more risk methods. Leverage industry benchmarking
to determine best practices and lessons learned regarding
components of the risk framework.
- Write and revise documents such as policies, standards,
procedures, and guidelines. Develop and enhance processes, tools,
templates, and job aids. Draft, contribute to, edit, and deliver
presentations that enable the design, development, refinement, and
usage of risk methods.Basic Qualifications:
- Bachelor's Degree or military experience
- At least 8 years experience in Cybersecurity, Technology, or
Cyber Internal or External Audit, or a combination
- At least 8 years of experience planning and leading IT audits
or risk assessments
- At least 5 years of People Management experience
- At least 5 years of experience in data management and
performing data analysis in support of cybersecurity assessments
and control design in a cloud environment (preferably AWS).
-Preferred Qualifications:
- 12 years experience in Cybersecurity, Technology, or Cyber
Internal or External Audit, or a combination.
- Cybersecurity, technology risk, and technology specific
certifications such as Certified Information Systems Security
Professional (CISSP), AWS Security certification, Certified
Information Systems Auditor (CISA), Certified in Risk and
Information Systems Control (CRISC), Certified Information Security
Manager (CISM), AWS DevOps certification
- 10 years of experience in performing Control Self Assessments
(CSAs), or completing assessments against established industry risk
frameworks, including the NIST Cybersecurity Framework
- 10 years experience performing data analysis in support of
internal risk assessments and control reviews
- 8 years of CI/CD, DevOps, SDLC framework experience
- 3 years of Financial Services industry experience
- Excellent verbal presentation and written communication skills
to confidently interact with the cyber organization and enterprise
stakeholders
- Excellent problem-solving, analytical, and critical thinking
skills to effectively respond to shifting priorities, demands, and
timelines
- Consulting experience with a Big 4 firm is a plus
- Experience deploying, configuring, and performing risk
assessments of industry leading CI/CD tools and supporting
technologies (e.g., Jenkins, Artifactory/jfrog, kubernetes,
etc.)
- DevOps experience is a plus
- Proficient with G Suite / Google Workspace for reports,
analysis, and presentations is a plusAt this time, Capital One will
not sponsor a new applicant for employment authorization for this
position.The minimum and maximum full-time annual salaries for this
role are listed below, by location. Please note that this salary
information is solely for candidates hired to perform work within
one of these locations, and refers to the amount Capital One is
willing to pay at the time of this posting. Salaries for part-time
roles will be prorated based upon the agreed upon number of hours
to be regularly worked.New York City (Hybrid On-Site): $233,100 -
$266,000 for Director, Cyber Risk & AnalysisCandidates hired to
work in other locations will be subject to the pay range associated
with that location, and the actual annualized salary amount offered
to any candidate at the time of hire will be reflected solely in
the candidate's offer letter.This role is also eligible to earn
performance based incentive compensation, which may include cash
bonus(es) and/or long term incentives (LTI). Incentives could be
discretionary or non discretionary depending on the plan.Capital
One offers a comprehensive, competitive, and inclusive set of
health, financial and other benefits that support your total
well-being. Learn more at the -Capital One Careers website.
Eligibility varies based on full or part-time status, exempt or
non-exempt status, and management level.This role is expected to
accept applications for a minimum of 5 business days.No agencies
please. Capital One is an equal opportunity employer committed to
diversity and inclusion in the workplace. All qualified applicants
will receive consideration for employment without regard to sex
(including pregnancy, childbirth or related medical conditions),
race, color, age, national origin, religion, disability, genetic
information, marital status, sexual orientation, gender identity,
gender reassignment, citizenship, immigration status, protected
veteran status, or any other basis prohibited under applicable
federal, state or local law. Capital One promotes a drug-free
workplace. Capital One will consider for employment qualified
applicants with a criminal history in a manner consistent with the
requirements of applicable laws regarding criminal background
inquiries, including, to the extent applicable, Article 23-A of the
New York Correction Law; San Francisco, California Police Code
Article 49, Sections 4901-4920; New York City's Fair Chance Act;
Philadelphia's Fair Criminal Records Screening Act; and other
applicable federal, state, and local laws and regulations regarding
criminal background inquiries.If you have visited our website in
search of information on employment opportunities or to apply for a
position, and you require an accommodation, please contact Capital
One Recruiting at 1-800-304-9102 or via email at
RecruitingAccommodation@capitalone.com. All information you provide
will be kept confidential and will be used only to the extent
required to provide needed reasonable accommodations.For technical
support or questions about Capital One's recruiting process, please
send an email to Careers@capitalone.comCapital One does not
provide, endorse nor guarantee and is not liable for third-party
products, services, educational tools or other information
available through this site.Capital One Financial is made up of
several different entities. Please note that any position posted in
Canada is for Capital One Canada, any position posted in the United
Kingdom is for Capital One Europe and any position posted in the
Philippines is for Capital One Philippines Service Corp.
(COPSSC).
Keywords: Capital One, Yonkers , DIRECTOR, DEVELOPER EXPERIENCE (DEVEX) TECHNOLOGY AND PRODUCT RISK GUIDE, Executive , New York, New York
Didn't find what you're looking for? Search again!
Loading more jobs...