Risk & Compliance Project Manager and Application Manager

Role Overview

The Risk & Compliance Project Manager and Application Manager is a dual-mandate leadership role designed to oversee the end-to-end lifecycle, stability, and evolution of critical enterprise risk, regulatory, and compliance software applications, while concurrently driving large-scale regulatory and compliance technology initiatives.

This hybrid position bridges business risk units, compliance officers, information security teams, internal/external auditors, and core IT engineering groups. The incumbent ensures that business-critical compliance applications operate reliably, securely, and in full alignment with evolving domestic and global regulatory standards (e.g., SOX, GDPR, GLBA, DORA, Basel/FRTB, AML/KYC), while managing multi-stream technical projects from inception through delivery.

Key Responsibilities

Part A: Application Management & Operational Governance

• Lifecycle & Operational Ownership: Own the operational health, support frameworks, SLA adherence, and ongoing lifecycle of GRC (Governance, Risk, and Compliance), RegTech, and audit platforms.

• Application Availability & Resiliency: Oversee system performance, disaster recovery planning, business continuity (BCP/DR), and observability for mission-critical risk data pipelines and reporting engines.

• Release & Change Management: Govern change control boards (CCB) and application release schedules, ensuring all configuration changes, patches, and version upgrades maintain strict auditability and minimal operational downtime.

• Incident & Problem Management: Act as technical escalation lead for high-severity incidents, orchestrating rapid resolution, root-cause analysis (RCA), and preventative control remediation.

• Access Governance & Data Protection: Enforce least-privilege role-based access control (RBAC), segregation of duties (SoD), and sensitive data encryption across all managed compliance systems.

Part B: Risk, Compliance & Regulatory Assurance

• Regulatory Interpretation & Alignment: Translate new regulatory mandates, industry frameworks, and supervisory guidance into actionable application architecture requirements and project roadmaps.

• Audit & Exam Management: Serve as the primary technical interface for internal audit teams, external regulatory bodies, and third-party risk assessors; ensure timely delivery of evidentiary artifacts and control testing data.

• Issue Tracking & Remediation (CAPs/MRAs): Manage the identification, tracking, and technical remediation of audit findings, corrective action plans (CAPs), Matters Requiring Attention (MRAs), and vulnerability assessments.

• Continuous Control Monitoring: Design and maintain automated key risk indicators (KRIs) and key control indicators (KCIs) embedded within application workflows.

Part C: Project & Program Management

• End-to-End Project Delivery: Lead complex regulatory technology and compliance integration initiatives from scoping, business case formulation, and milestone tracking to deployment and operational handover.

• Methodology & Governance: Apply Agile, Waterfall, or hybrid project management methodologies to coordinate cross-functional sprints, release gates, and steering committee cadences.

• Scope, Budget & Resource Management: Manage project schedules, resource allocations, dependency risks, and financial budgets (CapEx/OpEx).

• Executive Reporting & Stakeholder Alignment: Deliver comprehensive project scorecards, risk burndown charts, and executive status dashboards to Chief Risk Officers (CRO), Chief Compliance Officers (CCO), and IT leadership.

Part D: Vendor & Third-Party Risk Management

• Vendor Oversight: Oversee relationships with GRC/RegTech software vendors and implementation partners, monitoring performance against contractual SLAs and statements of work (SOWs).

• Third-Party Risk Assessment (TPRM): Conduct ongoing third-party technology risk assessments, SOC report reviews, and security posture evaluations for vendor-hosted applications.

Required Qualifications & Experience

Professional Experience

• 6–8+ years of progressive experience spanning IT application management, technology project management, and technology risk/compliance governance within regulated environments (e.g., Financial Services, Banking, Healthcare, or FinTech).

• Proven track record of managing enterprise GRC/RegTech platforms (e.g., ServiceNow IRM/GRC, Archer, MetricStream, OneTrust, Actimize, or proprietary risk calculation engines).

• Demonstrated experience delivering high-stakes regulatory technology projects, managing regulatory examinations, and resolving audit findings.

Technical & Domain Competencies

• Regulatory Frameworks: Strong working knowledge of major regulatory standards and control frameworks (e.g., NIST CSF, ISO 27001, SOX 404, SOC 1/2, GDPR, DORA, FFIEC, PCI-DSS).

• Project & Service Methodologies: Proficiency in Agile (Scrum/Kanban), Waterfall, and ITIL Service Management frameworks (Change, Incident, Problem, Release).

• Technology Stack Awareness: Solid understanding of enterprise software architectures, relational/non-relational databases (SQL), API integrations, ETL/data pipelines, and cloud computing environments (AWS/Azure/GCP).

• Tools & Platforms: Hands-on experience with project management and collaboration platforms (Jira, Confluence, MS Project, Smartsheet) and monitoring tools (Splunk, Datadog).

Leadership & Soft Skills

• Exceptional stakeholder management skills, capable of bridging technical engineering discussions and executive legal/compliance expectations.

• Proven negotiation and influence skills with internal business leaders and external regulatory examiners.

• Strong analytical and problem-solving mindset with high attention to precision and evidentiary detail.

Preferred Certifications

Candidates holding a combination of project management, risk governance, and IT service certifications will be given strong preference:

• Risk & Compliance: CRISC (Certified in Risk and Information Systems Control), CISA (Certified Information Systems Auditor), CISM (Certified Information Security Manager), or CRMA (Certification in Risk Management Assurance).

• Project Management: PMP (Project Management Professional), PMI-ACP, Certified ScrumMaster (CSM), or SAFe Program Consultant / Agilist.

• IT Service & Architecture: ITIL v4 Foundation / Managing Professional, TOGAF, or Cloud Fundamentals Certification (AWS/Azure).

Education

• Bachelor’s degree in Computer Science, Information Systems, Cyber/Information Security, Finance, Risk Management, or related field (Master’s degree or MBA preferred).

------------------------------------------------------

------------------------------------------------------

------------------------------------------------------

------------------------------------------------------

------------------------------------------------------

------------------------------------------------------

------------------------------------------------------

We use automated processing, including artificial intelligence, for our legitimate business interests (or our reasonable and appropriate business purposes) to identify and align the candidate's skills and abilities with a specific job opening. Additionally, if you so choose, or consent, we can match your skills and abilities to other suitable roles at Citi.

Importantly, all our hiring processes and decisions, including determining your suitability for a role, are conducted, checked, and decided by individuals. Our automated processing and AI do not involve relying on automatic or autonomous decision-making. Please refer to any Jurisdictional Considerations, with specific provisions for your country (where relevant) for further details.

------------------------------------------------------

This job opening is for an existing job vacancy.

------------------------------------------------------

Citi is an equal opportunity employer, and qualified candidates will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other characteristic protected by law.

If you are a person with a disability and need a reasonable accommodation to use our search tools and/or apply for a career opportunity review Accessibility at Citi.
View Citi’s EEO Policy Statement and the Know Your Rights poster.