IT Risk and Governance Manager

Location:

324 N. 4th Street

Indiana, PA 15701

or

358 N Shore Dr,

Pittsburgh, PA 15212

Hours:

Monday - Friday 8:00AM-5:00PM

(Additional hours as necessary to meet the objectives of the department)

Function:

Oversees the governance, risk management, compliance, and control framework for the Information Technology organization. Serves as an embedded risk and governance advisor, ensuring regulatory, risk, security, and control requirements are incorporated into technology planning, solution design, project delivery, and ongoing operations. Acts as the primary liaison between Information Technology, Enterprise Risk Management, Compliance, Internal Audit, Information Security, and regulatory agencies. Maintains the IT governance framework, coordinates audits and examinations, evaluates control effectiveness, and drives control optimization through process improvements and automation to enhance operational efficiency, business growth, and risk-informed decision making.

Duties and Responsibilities:

· Evaluates and addresses technology risks in alignment with the Bank’s risk appetite, strategic objectives, and regulatory requirements.

· Serves as the primary subject matter expert for Information Technology governance, risk management, policy administration, audit coordination, and regulatory compliance.

· Serves as an embedded risk advisor to technology teams during project initiation, solution selection, implementation planning, and retirement, providing proactive guidance on governance, compliance, and control requirements throughout the technology lifecycle.

· Establishes and administers a governance review process for new technology initiatives, major system changes, and strategic technology investments to ensure appropriate risk, compliance, and control considerations are addressed prior to implementation.

· Provides governance and risk oversight for significant technology initiatives, implementations, standards, and strategic investments to ensure compliance with governance standards, risk management requirements, and regulatory expectations.

· Leads governance and risk management efforts related to artificial intelligence, intelligent automation, and other emerging technologies, including use case reviews, risk assessments, acceptable-use standards, compliance monitoring, and control recommendations to support responsible adoption.

· Acts as the primary point of coordination between Information Technology, Enterprise Risk Management, Compliance Risk Management, Audit, Security, Legal, and regulatory agencies.

· Maintains and enhances the Information Technology governance framework, ensuring alignment with business objectives, risk management standards, regulatory requirements, and industry best practices.

· Oversees the inventory, ownership, review schedules, and lifecycle management of Information Technology policies, standards, and procedures to ensure timely updates and regulatory compliance.

· Coordinates Information Technology participation in audits, regulatory examinations, and risk assessments, including gathering evidence, facilitating meetings, and tracking remediation activities.

· Assists management in developing audit responses, corrective action plans, and remediation timelines for identified findings, recommendations, and control deficiencies.

· Partners with Security department to evaluate the design and effectiveness of technology controls and recommend enhancements to strengthen risk mitigation, compliance, and operational resilience.

· Identifies opportunities to optimize controls through standardization, process improvements, automation, and technology capabilities, reducing reliance on manual processes while maintaining appropriate oversight.

· Maintains the Information Technology risk register in accordance with Enterprise Risk Management framework and standards, and monitors risk treatment plans, policy exceptions, and remediation activities through resolution.

· Coordinates and supports the development and maintenance of Information Technology Risk and Control Self-Assessments (RCSAs), documenting risks, controls, control owners, and mitigation strategies.

· Facilitates the review, documentation, approval, monitoring, and reporting of technology risk acceptances, policy exceptions, compensating controls, and associated remediation plans.

· Coordinates governance oversight, risk assessment, remediation tracking, and reporting activities associated with technology-related incidents, control failures, compliance gaps, and audit findings.

· Provides technology risk oversight for vendor selection, third-party solutions, cloud services, and strategic technology partners in collaboration with Vendor Management, Information Security, and business stakeholders.

· Provides risk insight, reporting, analysis, and recommendations to Information Technology leadership for governance, risk, compliance, cybersecurity, vendor management, and other management committees.

· Develops and delivers education, awareness, and training programs to improve understanding of risk management, governance, compliance requirements, control responsibilities, and policy adherence across Information Technology.

· Coordinates the collection, analysis, and reporting of Key Risk Indicators (KRIs), Key Performance Indicators (KPIs), audit findings, policy exceptions, and other governance metrics for management and committee reporting.

· Serves as the primary liaison and coordinator for the Executive Technology and Operations Committees (ETOC) and Technology and Operations Committee (TOPCO), preparing and coordinating presentations, dashboards, analysis, recommendations, and follow-up actions to support Information Technology leadership.

· Monitors and interprets banking regulatory developments, FFIEC guidance, emerging risks, and industry best practices, translating requirements into actionable technology governance, policy, control, and operational improvements.

· Serves as a trusted advisor to Information Technology leadership, enabling the organization to deliver technology solutions efficiently while maintaining strong governance, effective controls, and regulatory compliance.

· Leads cross-functional initiatives to improve risk management maturity, governance practices, operational effectiveness, and overall control environment across the Information Technology organization.

· Performs ad-hoc risk, governance, compliance, and audit-related analysis and special projects as requested by senior management.

· Demonstrates strong analytical, problem-solving, and organizational skills, and the ability to navigate in an environment where the path forward may not always be immediately clear.

· Maintains effective working relationships with key stakeholders across multiple locations, managing up when necessary and appreciating the give/take nature of partnership.

Education:

Requires a four-year college degree in Information Technology, Cybersecurity, Information Systems, Risk Management, Business Administration, or related discipline. Preferred CRISC (Certified in Risk and Information Systems Control), CISA (Certified Information Systems Auditor), CGEIT (Certified in the Governance of Enterprise IT).

Experience:

Requires five to ten years of general experience and five to ten years of specialized experience. Experience in banking or financial services technology risk management, including IT governance, IT audit, regulatory examinations, information security governance, third-party technology risk management, policy administration, cloud and SaaS governance, and emerging technology risk management (including artificial intelligence and automation).

Physical Demands:

Operates a keypad device 80-90% of the day; operates electronic equipment 10-20% of the day. Traveling to alternate work locations 10-20%, overnight stays 10-20%. Primary body parts involved include fingers, thumb, hand, wrist and elbows. Reasonable accommodations