SENIOR CONTROLS ASSESSMENT & TESTING SPECIALIST • TECH AND OPS FIRST LINE RISK

Executes independent control testing and remediation validation activities across Technology, Cybersecurity, and Data domains.

Responsibilities

• Partners with Risk Advisors, Risk Owners, and Control Owners to assess control design and operating effectiveness, identify control gaps, and validate remediation efforts.
• Supports risk management activities through testing execution, issue evaluation, reporting, and ongoing enhancement of the control testing program.
• Support execution of the Annual Controls Testing Plan by completing assigned testing engagements and contributing to risk-based testing coverage across Technology, Cybersecurity, and Data risk domains.
• Partner with Risk Advisors, Risk Owners, Control Owners, and Process Owners to understand risks, control objectives, and processes, and identify testing attributes and required evidence.
• Assess control design and operating effectiveness in accordance with established testing methodologies, procedures, standards, and quality assurance requirements to determine whether controls are appropriately designed and operating effectively.
• Identify control deficiencies, documentation gaps, and opportunities for improvement, and communicate observations to stakeholders in a clear and professional manner.
• Evaluate remediation activities and supporting evidence to determine whether identified issues, audit findings, regulatory matters, and control deficiencies have been effectively addressed.
• Document testing procedures, results, conclusions, and supporting evidence in accordance with established testing standards and documentation requirements.
• Assist with preparation and response to regulatory engagements, including gathering documentation, coordinating evidence requests, and supporting exam management activities.
• Prepare summaries of testing results, observations, remediation status, and emerging themes for management reporting.
• Contribute to continuous improvement efforts by identifying opportunities to enhance testing methodologies, procedures, reporting, and quality assurance practices.
• Understand and adhere to the Company's risk and regulatory standards, policies, and controls in accordance with the Company's Risk Appetite.
• Identify risk-related issues requiring escalation to management.
• Promote an environment that supports diversity and reflects the M&T Bank brand.
• Complete other related duties as assigned.
• Scope of Responsibilities Primarily interacts with senior leaders within Technology and Cybersecurity, senior people leaders, and internal partners such as the Risk Division and Internal Audit.
• Works with general guidance and established procedures, exercising judgment in applying testing methodologies, evaluating evidence, and developing conclusions.
• Applies professional judgment in determining testing approaches, sample selections, issue evaluations, and remediation validation activities for assigned engagements.
• Identifies and communicates control gaps, risk concerns, and process improvement opportunities to management and stakeholders.
• Develops working knowledge of control testing methodology, control design assessment, operating effectiveness testing, issue management, and remediation validation practices.
• Prepares management reporting on testing results, thematic observations, control environment maturity, remediation status, and emerging risk trends.
• May participate in regulatory examinations, audits, and risk management reviews under the direction of senior Technology and Cybersecurity Risk leaders.
• Supervisory/Managerial Responsibilities No supervisory responsibilities.

Requirements

• Required Bachelor's degree and a minimum of 3 years' relevant work experience, or in lieu of a degree, a combined minimum of 7 years' higher education and/or work experience.
• Demonstrated proficient knowledge of Technology and/or Cybersecurity risk principles.
• Minimum of 2 years' relevant work experience in or with risk, audit, technology, cybersecurity, or a related area.
• Knowledge of cybersecurity principles and industry best practices relevant to confidentiality, integrity, and availability.
• Experience meeting strict deadlines.
• Preferred Applicable certification aligned to the function or domain, such as: Certified in Risk and Information Systems Control (CRISC®) Certified Information Systems Auditor (CISA) Certified Information Security Manager (CISM) Certified Information Systems Security Professional (CISSP) Proficient critical thinking and problem-solving skills.
• Excellent written and verbal communication skills.
• Experience collaborating with peers and leadership to deliver results.
• Demonstrated curiosity, with the ability to seek critical information and apply learnings.
• Ability to adapt seamlessly to changing priorities and deliver results aligned with business needs.
• Experience gaining buy-in from others to align on processes.

Pay

• M&T Bank is committed to fair, competitive, and market-informed pay for our employees.
• The pay range for this position is $85,800.00 - $143,000.00 Annual (USD).
• The successful candidate’s particular combination of knowledge, skills, and experience will inform their specific compensation.

Location

Buffalo, New York, United States of America