Compliance and Operational Risk Manager – Application Security and Technology Risk Oversight

About the role

Bank of America is guided by a common purpose to help make financial lives better through the power of every connection. The firm emphasizes responsible growth, an inclusive workplace, and a culture of caring that supports teammates’ physical, emotional, and financial wellness. This position is responsible for executing second‑line‑of‑defense compliance and operational risk oversight for Front Line Units, Control Functions, and/or Third Parties, ensuring adherence to the Global Compliance Enterprise Policy, the Operational Risk Management Enterprise Policy, and related standard operating procedures. The role serves as a trusted advisor and challenger to senior technology leaders, providing risk oversight, governance, and strategic advisory to support cybersecurity, operational resilience, and regulatory objectives.

Responsibilities

• Assess risks and effectiveness of Front‑Line Unit (FLU) processes and controls to ensure compliance with applicable laws, rules, and regulations, and respond to regulatory inquiries, audits, and examinations.
• Provide independent compliance and operational risk oversight of FLU or Control Function (CF) performance and related third‑party/vendor relationships in alignment with the Global Compliance and Operational Risk Management policies and programs.
• Identify and escalate problems or issues, driving actions to address root causes that lead to compliance risk issues or operational risk losses.
• Monitor inventory of processes, risks, controls, and associated metrics for risk appetite and limits, reporting violations of compliance or regulatory activities.
• Assist in developing independent risk‑management reporting for coverage areas as input into country/regional governance and management routines.
• Analyze and interpret applicable laws, rules, and regulations to provide clear, practical advice to stakeholders and to identify and manage risks.
• Review and challenge FLU/CF processes, risk inventories, and Risk and Control Self‑Assessment results, monitoring regulatory changes applicable to coverage areas.
• Monitor and assess adherence to Global Technology policies and standards.
• Perform inline review of ITGPST issue‑management activities, including remediation of regulatory issues.
• Provide independent second‑line oversight of the Bank’s Application and Technology Security Assessment program, assessing control effectiveness, risk identification, issue management, and regulatory compliance.
• Assess technology and cyber risks across critical applications, business processes, and technology environments.
• Review and challenge risk‑acceptance decisions, remediation strategies, and control design associated with application security risks.
• Monitor emerging technology and AI‑related risks, evaluating evolving cyber threats, governance frameworks, and control environments to ensure appropriate risk‑management practices.
• Support executive reporting, governance routines, and strategic communications for senior‑leadership audiences.
• Evaluate adherence to enterprise risk‑management standards, technology policies, and regulatory expectations.
• Partner across technology, cybersecurity, risk, audit, and business teams to strengthen operational resilience and risk‑management practices.

Required Qualifications

• 7+ years of experience in operational risk, technology risk, information security, cybersecurity, compliance, audit, or related risk‑management disciplines, preferably within a large financial institution.
• Demonstrated expertise in cybersecurity, application security, technology governance, third‑party technology risk management, or operational resilience.
• Proven ability to influence and challenge senior leaders and executive stakeholders while maintaining effective partnerships.
• Experience supporting regulatory examinations, audit engagements, issue remediation programs, and risk‑governance activities.
• Strong background with the Global Compliance & Operational Risk program from a 1st or 2nd line perspective.
• Clear, impactful communication skills; comfortable engaging at the executive level and shaping outcomes.
• Understanding of AI‑related risks, governance considerations, cybersecurity implications, and technology‑enabled solutions to support risk‑management activities.
• Familiarity with GCOR programs, Global Technology policies, and ITGPST processes and risks.
• Skilled in identifying, assessing, and remediating operational risks and issues.
• Proficient in generating actionable insights through data analysis and reporting tools.
• Ability to build trust, challenge constructively, and partner effectively across the enterprise.
• Proficiency with industry security frameworks (e.g., NIST CSF) and applicable laws, rules, and regulations.

Desired Qualifications

• Familiarity with Application Technology Security Assessments, vulnerability management, software development lifecycle controls, or application security testing programs.
• Understanding of emerging technology risks, including AI governance, model‑risk considerations, and cybersecurity implications of AI‑enabled technologies.
• Professional certifications such as CISSP, CISM, CRISC, CISA, or equivalent risk and technology certifications.
• Second or third line of defense experience or experience in a business risk and controls role.
• Strong familiarity with the Global Compliance & Operational Risk (GCOR) program and related tools/applications.
• Familiarity with the Issues Management program and tools.
• Demonstrated success leading targeted assessments, audits, or regulatory exam engagements, including authoring responses, report‑outs, and observations.
• Ability to constructively challenge and support opinions and recommendations with facts and data.
• Proven track record of productive partnering with stakeholders across the enterprise at all levels.

Skills

• Advisory
• Monitoring, surveillance, and testing
• Regulatory compliance
• Reporting
• Risk management
• Critical thinking
• Influence
• Interpretation of relevant laws, rules, and regulations
• Issue management
• Policies, procedures, and guidelines management
• Business process analysis
• Decision making
• Negotiation
• Process management
• Written communications

Schedule

1st shift (United States), 40 hours per week.