Senior Manager Technology Risk and Governance

At TruStage, we’re on a mission to make a brighter financial future accessible to everyone.  We put people first, and work hand in hand with employees and customers to create a diverse and inclusive environment. Passionate about building insurance and financial services solutions, we push the boundaries of what’s possible. We need you to help us shape what’s next. You’ll be encouraged to share your experiences, ideas and skills to help others take control of their financial future.

Join a team that has received numerous awards for being a top place to work: TruStage awards and recognition

Job Summary

The Senior Manager, Technology Compliance is responsible for coordinating technology-related compliance and assurance activities and customer due diligence requests across the Enterprise Information and Technology organization. This role acts as the primary conduit between internal and external assurance stakeholders (e.g., Internal Audit, regulators, external auditors, customer due diligence teams) and the technology teams accountable for providing evidence, operating controls, and remediating identified gaps.

This role establishes and manages a structured operating model for:
•    Coordination of technology audits and examinations;
•    Responses to customer and third-party due diligence inquiries;
•    Governance and reporting for accepted technology risks;
•    Monitoring and escalation of remediation activities tied to assurance findings;
•    Support for ongoing technology compliance transparency.

The role provides centralized coordination, oversight, reporting, and process discipline to improve consistency, timeliness, and accountability across technology compliance obligations.  It is responsible for coordination, governance, tracking, and reporting of technology compliance and assurance activities.

Job Responsibilities:
 

Audit and Examination Coordination

• Serve as the central coordination point for internal audit, external audit, regulatory review, and other assurance activities impacting technology.
• Manage intake, prioritization, and organization of Technology related audit/examination requests and route them to the appropriate accountable technology teams.
• Establish and enforce clear timelines, deliverables, and governance mechanisms for evidence collection and response protocols for audit engagements.
• Review evidence submitted by accountable technology teams for completeness, consistency, and quality before final delivery to auditors or examiners. 
• Maintain a centralized repository of audit documentation, evidence, responses, findings, and remediation commitments.
• Track open issues and remediation actions resulting from audits or exams and provide status reporting to technology leadership.
• Drive consistency in how technology responds to assurance requests across infrastructure & operations, engineering & application support, operations, information security, architecture, Automation/AI and data teams.

Customer Due Diligence and Assurance Response Management

• Coordinate responses to customer data, security, and technology due diligence requests, including questionnaires, supporting documentation, and follow-up clarifications.
• Partner with Information Security, Privacy, Legal, Risk, Procurement, and Technology teams to gather and validate required responses as appropriate.
• Maintain a library of standard responses, reusable evidence artifacts, and approved language to improve response efficiency and consistency.
• Identify recurring themes or gaps from customer due diligence requests or evidence gaps and recommend process, control, or documentation improvements.
• Support sales, account management, procurement, and functions with timely and accurate technology assurance information.

Accepted Technology Risk Governance

• Administer and maintain a centralized inventory and dashboard of accepted technology risks, including key attributes such as risk articulation, technology approver, business approver, risk owner, business justification, compensating controls, duration, expiration dates and review cycle.
• Ensure accepted risks are documented consistently and reviewed in accordance with policy and governance requirements.
• Monitor risk acceptance reviews, acceptance durations, expirations and revalidation requirements.
• Track upcoming expirations, re-approvals, and overdue reviews, and escalate as needed.
• Provide reporting and insights on risk acceptance trends, concentration and exposures. 
• Facilitate governance routines for risk acceptance review and escalation.
• Provide transparency into risk acceptance decisions without assuming ownership of the underlying risks.

Issue Management and Remediation Oversight

• Track remediation commitments associated with audit findings, assessments, customer issues, and compliance reviews.
• Monitor progress against action plans and escalate delays, unclear ownership, or inadequate closure evidence.
• Facilitate issue governance routines, including status reviews, risk escalation.
• Help ensure findings and remediation actions are traceable, auditable, and aligned to enterprise issue-management standards.
• Ensure appropriate documentation and evidence support for issue closure.

Process Governance and Continuous Improvement

• Design and maintain repeatable processes, procedures, templates, and playbooks for audit coordination, due diligence response management, and risk acceptance reporting.
• Define metrics and dashboards related to cycle time, issue aging, evidence quality, response timeliness, and remediation performance.
• Identify opportunities to streamline assurance interactions, reduce redundancy, and improve stakeholder experience.
• Support the maturity of technology compliance practices by strengthening documentation discipline, intake workflows, and executive reporting.

Stakeholder and Leadership Engagement

• Build and maintain strong relationships across Technology, Information Security, Enterprise Risk, Legal, Privacy, Internal Audit, Finance and business stakeholders.
• Communicate complex technical control and compliance information into clear and concise status updates and actionable insights for leadership.
• Prepare executive summaries, dashboards, and briefing materials.
• Escalate material risks, delays, or recurring control concerns in a timely and objective manner.

The above statement of duties is not intended to be all inclusive and other duties will be assigned from time to time.

Job Requirements:

• Bachelor’s degree in information technology, cybersecurity, risk management, accounting, business, or related field, or equivalent combination of education and/or related professional work experience.
• 7+ years of experience in one or more of the following areas:
  • Technology risk management;
  • IT compliance or IT audit;
  • Information Security governance;
  • Operational risk;
  • Issue management or compliance coordination;
  • Technology control functions.
• Demonstrated experience coordinating internal/external audits, regulatory exams, or customer due diligence requests.
• Strong understanding of technology control environments, including areas such as identity and access management, vulnerability management, change management, infrastructure operations, third-party technology services, backup/recovery, and incident response.
• Experience in a regulated industry such as financial services, insurance, healthcare, or utilities.
• Familiarity with common control and regulatory frameworks such as:
• NIST Cybersecurity Framework, COBIT, ISO 27001, SOC 1 / SOC 2, FFIEC, NYDFS, PCI DSS, OSFI B-13, COSO or other relevant technology risk/compliance standards.
• Experience developing metrics, dashboards, managing issue portfolios and governance reporting for technology risk and compliance activities.
• Strong organizational and program management skills with the ability to manage multiple concurrent requests and deadlines.
• Excellent written and verbal communication skills, including the ability to synthesize technical input into executive-ready reporting.
• Proven ability to work cross-functionally through indirect influence of contributing teams.
• Professional certifications such as CGRC, CRISC, CISM, CISSP or CIA are a plus.
• Experience with Governance, Risk, and Compliance (GRC) platforms or audit management tools.

At this time, we're not considering applicants that need any type of immigration sponsorship (additional work authorization or permanent work authorization) now or in the future to work in the United States. This includes, but IS 
NOT LIMITED TO: F1-OPT, F1-CPT, H-1B, TN, L-1, J-1, etc

#LI-SW

If you’re ready to help make a difference, apply today.  A resume is required to apply. TruStage may process applicant information using an Artificial Intelligence (AI) tool.  This tool automatically generates a screening score based on how well applicant information matches the requirements and qualifications for the position. TruStage recruiters use the screening score as a guide to further evaluate candidates; the score is one component of an application review and does not automatically determine whether a candidate moves forward.  Candidates may choose to opt out of this process.

Compensation may vary based on the job level, your geographic work location, position incentive plan and exemption status.

 

Base Salary Range:

$135,500.00 - $203,300.00

 

At TruStage, we believe a sound, inclusive benefits program is of vital importance, along with a flexible workplace that allows for work-life balance, career growth and retirement assistance. In addition to your base pay, your position may be eligible for an annual incentive (bonus) plan.  Additional benefits available to eligible employees include medical, dental, vision, employee assistance program, life insurance, disability plans, parental leave, paid time off, 401k, and tuition reimbursement, just to name a few. Beyond pay and benefits, we also recognize that flexibility, including working in a place you prefer, is essential to caring for our employees.  We will continue to strive to offer flexibility and invest in technology and other tools that will make hybrid working normal rather than an exception, so that when “life happens,” you can focus on what’s most important.

Accommodation request

TruStage is a place where everyone can bring their best self and thrive. If you need application or interview process accommodations, please contact the accessibility department.