Overview:

This role is responsible for full ownership of the Audit Division’s assurance product specific to domains within the Technology Division of the Bank. This includes leading a diverse team of IT Audit staff and guiding the risk-based prioritization of continuous monitoring and assurance work over the areas of technology infrastructure and operations, enterprise software engineering and platform services, technology service delivery, technology governance, enterprise architecture, and technology risk management. Proficient understanding of technology operations and related risks and controls within legacy data centers, co-location environments, and public cloud platforms is required as the organization continues its migration of operations to the cloud. This role requires an in-depth knowledge of traditional and modern technology architecture and tooling and both a willingness and aptitude to remain current on emerging technology shifts specific to financial services.  As a member of the Audit Senior Management Team this leadership role assists in the development and support of the department’s strategic vision including supporting continued enhancements to audit methodology, ongoing stakeholder engagement, talent management, and overall promotion of the Audit Department within the organization.   The role requires ongoing communication with seasoned IT leaders within the Technology Division having professional background and experience across various financial services organizations.  

Primary Responsibilities:

Full Ownership of Assurance Product for Various Areas Within the Technology Domain

• Own the construct and completion of the Audit Plan for assigned areas of the Technology Domain and demonstrate valued input overall. It is expected that a Senior Audit Manager is independent and proactive in addressing this responsibility and contributes a strategic perspective in doing so that is influenced by having a broad knowledgebase on the IT risks the Bank is exposed to and how IT Audit (functionally) can add value to the Bank.

Ownership is reflected through:

• Proactive knowledge gathering of the domain and demonstrated understanding of this within internal meetings and through interactions with Audit Directors
• Being a lead presence within audit scoping meetings and being a primary contributor to the discussions
• Establishing regular communications with the appropriate level of Technology management (typically middle and/or senior management) responsible for the technology within assigned domains to monitor the environment
• Proactively ensuring audit teams are timely in their completion of audit work and both draft/final reports.  Ensuring report review processes are managed to ensure enough time is allotted for the process (limited rushing due to deadlines)
• Managing staff to ensure end of fieldwork dates are consistently met, and exceptions have risk-based rationale that support extensions
• Demonstrating a willingness to lean in and execute when required/necessary
• Displaying understanding of existing risks within assigned domains, and the “business” of assigned domains
• Displaying understanding of emerging risks within assigned domains through initiative being taken to remain up to speed on emerging technologies and related risks
• Owning and being a driver of continuous auditing and monitoring activities being conducted within assigned domains 
• Proactively managing co-sourced relationships (where established in support of audit plan completion, and applicable to assigned domains)

• Support the department’s risk assessment process to determine audit coverage for the technology domain.
• Consult with business stakeholders regarding risk and control matters. This includes proposing solutions to audit findings, offering recommendations for control enhancements, and representing Audit on working groups within the business as appropriate.
• Manage multiple tasks concurrently in an efficient and effective manner with minimal oversight.
• Lead audit teams in incorporating the use of data analytics to drive decisions throughout all phases of the audit process.
• Clearly demonstrate visible support for and assist in driving the department’s strategic objectives.

Leadership, Decision Making, and Communication

• The individual in this role is expected to be highly influential to the team, a strong leader of change, and more strategic minded when guiding the team in day-to-day activities (bringing a big picture view).
• Supportive of strategy and decisions/approaches communicated down by senior leadership in IT Audit (is an advocate of these decisions/approaches to the floor)
• Supportive of direct manager in the achievement of his/her goals and objectives
• Delivers clear, concise, and well written Audit Reports for delivery to Bank management.  Reports should align to all Audit Manual and Report template expectations before delivery to the Director for review
• Is prepared for and is a driver of meetings with management in assigned portfolios and within internal department meetings.
• Ensures there is ongoing collaboration and alignment with 1st and 2nd line risk groups within assigned portfolios – where applicable.  All these groups should be on the same page regarding focus areas, identified risks, emerging risks, etc. 
• Can deliver/communicate technical concepts in a manner that allows for understanding by non-technical individuals

• Possess strong management and interpersonal skills, make sound decisions independently, exhibiting initiative and intuitive thinking.
• Build strong partnerships with and influence business stakeholders and audit team members.
• Interact directly with regulators during examinations and MRA/MRIA validations.
• Demonstrate strong judgment, political astuteness, and sensitivity to cultural diversity. 
• Adhere to applicable compliance/operational risk controls in accordance with Company or regulatory standards and policies.

Developing Others

• Coach, mentor, and oversee the work of junior audit team members, tailoring the approach based upon their skills and experience. Actively participate in overall staff development for the department.
• Work closely with the Audit Director concerning staffing, performance appraisals, promotions, salary recommendations, performance management and terminations for direct reports.
• Display ongoing reflection of a serve first mindset
• Establish an environment that promotes psychological safety for the team
• Demonstrate an ability to understand and value the strengths of each team member and their individual importance to the makeup of the broader team
• Have an unselfish motivation – being unselfish in every decision made and every action taken
• Show commitment to both doing and coaching
• Display a passion for continuous learning and continuously instill this into the broader team
• Reflect personal responsibility for maximizing team strengths

Scope of Responsibilities:

This role reports to an Audit Director and supports the overall direction and execution of the audit plan via high quality, timely and value-added audit services, which meet the requirements of the Audit Committee and regulatory expectations. This senior role also ensures ongoing conformance with professional auditing standards. This position directly communicates with Senior, Middle and Line Management and External Auditors.  Builds strong partnerships with business stakeholders and other audit team members.   The role also requires periodic interaction with external regulatory agencies.  Operates independently with minimal Audit Director oversight to deliver on time, high quality assurance product.

Education and Experience Required:

• The candidate should have in-depth knowledge of traditional and modern technology infrastructure such as servers, databases, network and storage infrastructure, cloud technology, and middleware/integration services, modern development and delivery practices, emerging technologies being used by financial services organizations, and core technology services and operations and related risks and controls (e.g., data center operations, change, incident, problem and asset management disciplines, enterprise architecture functions, software engineering disciplines, business continuity and operational resilience concepts, etc.)
• Working knowledge of technology risk management frameworks (e.g., CRI, ITIL 4, COBIT, etc.)
• Understanding of supervisory expectations and regulations specific to technology risk management practices (e.g., FFIEC IT Handbooks, NYSDFS NYCRR 500 – Cybersecurity Requirements for Financial Services Companies, Fed SR-Letters, etc.)
• Certifications related to technology risk management, IT Audit, cybersecurity risk management, etc. (e.g., CISSP, CISA, CCSK, etc.)
• Bachelor’s degree, preferably in Accounting, Business, Finance, Technology, Cybersecurity, Mathematics, Statistics or other related technical field and 10 years of relevant experience, inclusive of 4 years supervisory/managerial experience
• Related certifications (CISA or similar)
• Demonstrates strong judgment, political astuteness, and sensitivity to cultural diversity.
• Possesses strong project management and interpersonal skills, makes sound decisions, exhibiting initiative and intuitive thinking.
• Effective negotiation skills, a proactive and 'no surprises' approach in communicating issues and strength in sustaining independent views.
• This individual must be an articulate and effective communicator, both orally and in writing, with an energetic, charismatic and approachable style.
• Strong leadership skills and ability to develop and coach others

M&T Bank is committed to fair, competitive, and market-informed pay for our employees. The pay range for this position is $128,900.00 - $214,900.00 Annual (USD). The successful candidate’s particular combination of knowledge, skills, and experience will inform their specific compensation.

Location

Buffalo, New York, United States of America