Risk & Compliance Project Manager and Application Manager

The Risk & Compliance Project Manager and Application Manager is a dual-mandate leadership role designed to oversee the end-to-end lifecycle, stability, and evolution of critical enterprise risk, regulatory, and compliance software applications, while concurrently driving large-scale regulatory and compliance technology initiatives. This hybrid position bridges business risk units, compliance officers, information security teams, internal/external auditors, and core IT engineering groups.

Responsibilities

• The incumbent ensures that business-critical compliance applications operate reliably, securely, and in full alignment with evolving domestic and global regulatory standards (e.g., SOX, GDPR, GLBA, DORA, Basel/FRTB, AML/KYC), while managing multi-stream technical projects from inception through delivery.
• Application Management & Operational Governance Lifecycle & Operational Ownership: Own the operational health, support frameworks, SLA adherence, and ongoing lifecycle of GRC (Governance, Risk, and Compliance), RegTech, and audit platforms.
• Oversee system performance, disaster recovery planning, business continuity (BCP/DR), and observability for mission-critical risk data pipelines and reporting engines.
• Govern change control boards (CCB) and application release schedules, ensuring all configuration changes, patches, and version upgrades maintain strict auditability and minimal operational downtime.
• Act as technical escalation lead for high-severity incidents, orchestrating rapid resolution, root-cause analysis (RCA), and preventative control remediation.
• Enforce least-privilege role-based access control (RBAC), segregation of duties (SoD), and sensitive data encryption across all managed compliance systems.
• Risk, Compliance & Regulatory Assurance Regulatory Interpretation & Alignment: Translate new regulatory mandates, industry frameworks, and supervisory guidance into actionable application architecture requirements and project roadmaps.
• Serve as the primary technical interface for internal audit teams, external regulatory bodies, and third-party risk assessors; ensure timely delivery of evidentiary artifacts and control testing data.
• Manage the identification, tracking, and technical remediation of audit findings, corrective action plans (CAPs), Matters Requiring Attention (MRAs), and vulnerability assessments.
• Design and maintain automated key risk indicators (KRIs) and key control indicators (KCIs) embedded within application workflows.
• Project & Program Management End-to-End Project Delivery: Lead complex regulatory technology and compliance integration initiatives from scoping, business case formulation, and milestone tracking to deployment and operational handover.
• Apply Agile, Waterfall, or hybrid project management methodologies to coordinate cross-functional sprints, release gates, and steering committee cadences.
• Manage project schedules, resource allocations, dependency risks, and financial budgets (CapEx/OpEx).
• Deliver comprehensive project scorecards, risk burndown charts, and executive status dashboards to Chief Risk Officers (CRO), Chief Compliance Officers (CCO), and IT leadership.
• Vendor & Third-Party Risk Management Vendor Oversight: Oversee relationships with GRC/RegTech software vendors and implementation partners, monitoring performance against contractual SLAs and statements of work (SOWs).
• Conduct ongoing third-party technology risk assessments, SOC report reviews, and security posture evaluations for vendor-hosted applications.

Requirements

• Qualifications & Experience Professional Experience 6–8+ years of progressive experience spanning IT application management, technology project management, and technology risk/compliance governance within regulated environments (e.g., Financial Services, Banking, Healthcare, or FinTech).
• Proven track record of managing enterprise GRC/RegTech platforms (e.g., ServiceNow IRM/GRC, Archer, MetricStream, OneTrust, Actimize, or proprietary risk calculation engines).
• Strong working knowledge of major regulatory standards and control frameworks (e.g., NIST CSF, ISO 27001, SOX 404, SOC 1/2, GDPR, DORA, FFIEC, PCI-DSS).
• Proficiency in Agile (Scrum/Kanban), Waterfall, and ITIL Service Management frameworks (Change, Incident, Problem, Release).
• Solid understanding of enterprise software architectures, relational/non-relational databases (SQL), API integrations, ETL/data pipelines, and cloud computing environments (AWS/Azure/GCP).
• Hands-on experience with project management and collaboration platforms (Jira, Confluence, MS Project, Smartsheet) and monitoring tools (Splunk, Datadog).
• Leadership & Soft Skills Exceptional stakeholder management skills, capable of bridging technical engineering discussions and executive legal/compliance expectations.
• Proven negotiation and influence skills with internal business leaders and external regulatory examiners.
• Strong analytical and problem-solving mindset with high attention to precision and evidentiary detail.
• PMP (Project Management Professional), PMI-ACP, Certified ScrumMaster (CSM), or SAFe Program Consultant / Agilist.
• ITIL v4 Foundation / Managing Professional, TOGAF, or Cloud Fundamentals Certification (AWS/Azure).

Preferred

• Demonstrated experience delivering high-stakes regulatory technology projects, managing regulatory examinations, and resolving audit findings.
• Certifications Candidates holding a combination of project management, risk governance, and IT service certifications will be given strong preference: Risk & Compliance: CRISC (Certified in Risk and Information Systems Control), CISA (Certified Information Systems Auditor), CISM (Certified Information Security Manager), or CRMA (Certification in Risk Management Assurance).

Education

Bachelor’s degree in Computer Science, Information Systems, Cyber/Information Security, Finance, Risk Management, or related field (Master’s degree or MBA preferred). ------------------------------------------------------ Job Family Group: Technology ------------------------------------------------------ Job Family: Applications Development ------------------------------------------------------ Time Type: Full time ------------------------------------------------------ Primary Location Full Time Salary Range: $145,100.00 - $217,700.00 ------------------------------------------------------ Most Relevant Skills Please see the requirements listed above. ------------------------------------------------------ Other Relevant Skills For complementary skills, please see above and/or contact the recruiter. ------------------------------------------------------ Automated Processing and AI We use automated processing, including artificial intelligence, for our legitimate business interests (or our reasonable and appropriate business purposes) to identify and align the candidate's skills and abilities with a specific job opening. Additionally, if you so choose, or consent, we can match your skills and abilities to other suitable roles at Citi. Importantly, all our hiring processes and decisions, including determining your suitability for a role, are conducted, checked, and decided by individuals. Our automated processing and AI do not involve relying on automatic or autonomous decision-making.

Please refer to any Jurisdictional Considerations, with specific provisions for your country (where relevant) for further details. ------------------------------------------------------ This job opening is for an existing job vacancy. ------------------------------------------------------ Citi is an equal opportunity employer, and qualified candidates will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other characteristic protected by law. If you are a person with a disability and need a reasonable accommodation to use our search tools and/or apply for a career opportunity review Accessibility at Citi . View Citi’s EEO Policy Statement and the Know Your Rights poster.