IT Risk Principal

We need to output HTML fragment with sections: headings

for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real content. We need to parse the job posting. First, description summary: Duties & Responsibilities ... then bullet-like paragraphs. We need to extract sections: - About the role: maybe a brief description of role. The posting starts: "Description Summary: Duties & Responsibilities The IT Risk Principal is a member of Huntington’s Independent (2nd Line) IT Risk function. This 2nd line of defense role encompasses creation, improvement, and execution of Technology and Operational risk governance across the Bank, including partnership and oversight of front-line business and risk units, in alignment with the Enterprise Risk Framework." Thus we can put that as About the role. - Responsibilities: list of duties: "Primary responsibilities include the following with a focus on specific domain oversight: Management of processes to ensure credible challenge, oversight, and validation of IT risk findings/action plans/risk acceptances and 1st line risk and control assessments across the BankManagement and Oversight of assigned L2 risk(s) from our Risk Registry in alignment with our risk appetiteParticipation and Challenge within the IT Policies and Standards framework and processes to ensure output is aligned with risk appetite. This includes metrics, controls, process maps and other wholesale material for a healthy standard.Deliver periodic IT risk updates at governance meetings and active participation in the IT Risk Committee and associated sub-forumsDeliver quarterly independent IT Risk Assessments and targeted assessments in order to form and support the Bank’s IT risk profileProviding Risk Management leadership across the Bank’s Information Technology, and Operational risksAssisting with determining the IT Risk Program's strategy and areas of focusParticipation in our mentorship programs in alignment with our focus on colleague growth" We need to split into list items. The text is concatenated without punctuation. We need to parse manually. Let's list responsibilities: 1. Management of processes to ensure credible challenge, oversight, and validation of IT risk findings/action plans/risk acceptances and 1st line risk and control assessments across the Bank 2. Management and Oversight of assigned L2 risk(s) from our Risk Registry in alignment with our risk appetite 3. Participation and Challenge within the IT Policies and Standards framework and processes to ensure output is aligned with risk appetite. This includes metrics, controls, process maps and other wholesale material for a healthy standard. 4. Deliver periodic IT risk updates at governance meetings and active participation in the IT Risk Committee and associated sub-forums 5. Deliver quarterly independent IT Risk Assessments and targeted assessments in order to form and support the Bank’s IT risk profile 6. Providing Risk Management leadership across the Bank’s Information Technology, and Operational risks 7. Assisting with determining the IT Risk Program's strategy and areas of focus 8. Participation in our mentorship programs in alignment with our focus on colleague growth Also "Performs other duties as assigned." appears later under Basic Qualifications? Actually after Preferred Qualifications list there is "Performs other duties as assigned." That's a duty; we can include as responsibility. - Basic Qualifications: Bachelor's degree or equivalent level of work experience; Five or more years relevant experience in a technology role, directly supporting technology processes or assets (applications/systems/etc.) - Preferred Qualifications: list many items: Previous experience serving in a Governance/Risk/Compliance/Audit function, ideally in a leadership role and with a large firm; Effective advisory and collaboration skills, and ability to drive consensus; Advanced understanding of the IT process’ (developing, delivering, supporting technology) and associated grasp of Technology Risks and Controls; Logical and organized problem solver; Effective written and verbal communication skills. Resource needs to be effective at understanding the technical side but also able to document their assessment (or other analysis items as needed).; Critical/strategic thinker (able to look at something strategically and think risk, efficiency, cost, etc. – big picture ‘so what’ analysis and can execute what’s needed to help support the effort); Process oriented mindset and able to tell a story leveraging data; Time management/organized/ability to prioritize; Managerial courage and ability to effectively interact with various levels of leadership; Understanding of IT risk and control frameworks such as COBIT, etc.; In-depth knowledge of risk management processes and principles, including experience assessing risks, analyzing testing results and developing remediation plans; Strong preference for recognized industry certification such as ISACA CRISC/CISA/CISM, ISC2 CISSP/SSCP, or similar. Where these certifications are not possessed at the time of hire, the candidate will be expected to obtain certification within a 12-month period; Experience working in the Financial Services industry; KPI/KRI metrics and reporting experience; Additional specialized qualifications may be required based on the specific position - Exempt Status: Yes (not eligible for overtime pay). This is metadata; we can fold into a short p or drop. Probably we can include a short paragraph under maybe "Details". But we are told not to put Job ID/requisition numbers as headings; minor metadata can be folded into a short p or drop. So we can include a paragraph with Exempt Status and Workplace Type. - Workplace Type: Office; plus description about flexible work arrangement. That's content for maybe "Workplace" but we don't have a heading for Workplace; we could include under About the role or maybe a separate section "Workplace". But headings list only includes specific ones; we can create a section only if posting has real specific content for it. There's no explicit "Workplace" heading in the list, but we could put under About the role or maybe a separate "Details". However instructions: Use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we should stick to those headings only. So we should not create a Workplace heading. Instead we can incorporate workplace info into About the role or maybe a paragraph after. - Compensation Range: $93,000- $189,000 annual salary; plus note about incentive compensation plan. That's Pay section. - Benefits: "In addition, Huntington provides a variety of benefits to colleagues, including health insurance coverage, wellness program, life and disability insurance, retirement savings plan, paid leave programs, paid holidays and paid time off (PTO)." That's Benefits. - Schedule: Not mentioned explicitly; there is no schedule info. So we should not create Schedule section. - Skills: Could be derived from Preferred Qualifications (skills). But we have Qualifications section (maybe combine Basic and Preferred). The instructions: Use headings for Requirements, Qualifications, Skills. We need to decide what to put where. Typically Requirements = Basic Qualifications; Qualifications = Preferred Qualifications; Skills = maybe skillset list. But we can also merge. However we should not create thin sections. We have substantive content for Basic Qualifications and Preferred Qualifications. We could put Basic under Requirements, Preferred under Qualifications. Skills maybe not needed if covered. Thus sections: - About the role (h3) - Responsibilities (h3) with ul li - Requirements (h3) with ul li for Basic Qualifications - Qualifications (h3) with ul li for Preferred Qualifications - Benefits (h3) with ul li for benefits - Pay (h3) with p for compensation range and incentive note We should not include Schedule. We must preserve all substantive information; do not invent or summarize away detail. So we need to keep all details from Basic and Preferred Qualifications exactly as given (maybe rephrase slightly but keep meaning). We should not drop any. We need to remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. The posting includes "Huntington is an Equal Opportunity Employer. Tobacco-Free Hiring Practice: Visit Huntington's Career Web Site for more details. Note to Agency Recruiters: Huntington will not pay a fee for any placement resulting from the receipt of an unsolicited resume. All unsolicited resumes sent to any Huntington colleagues, directly or indirectly, will be considered Huntington property. Recruiting agencies must have a valid, written and fully executed Master Service Agreement and Statement of Work for consideration." This is boilerplate; we should remove. Also "Exempt Status: (Yes = not eligible for overtime pay) (No = eligible for overtime pay) Yes" we can keep as a short p maybe under About the role or a separate metadata paragraph. Since it's minor metadata, we can fold into a short p. Also "Workplace Type Office Our Approach to Office Workplace Type Certain positions outside our branch network may be eligible for a flexible work arrangement. We’re combining the best of both worlds: in-office and work from home. Our approach enables our teams to deepen connections, maintain a strong community, and do their best work. Remote roles will also have the opportunity to come together in our offices for moments that matter. Specific work arrangements will be provided by the hiring team." This is also metadata about workplace; we can fold into a short p. We need to ensure we don't repeat the job title as heading. Now produce HTML fragment. Structure:

About the role

...

Maybe include Exempt Status and Workplace Type in same p or separate. Let's craft About the role paragraph: combine the description summary and maybe mention exempt status and workplace. Description: "The IT Risk Principal is a member of Huntington’s Independent (2nd Line) IT Risk function. This 2nd line of defense role encompasses creation, improvement, and execution of Technology and Operational risk governance across the Bank, including partnership and oversight of front-line business and risk units, in alignment with the Enterprise Risk Framework." Add Exempt Status: "Exempt status: Yes (not eligible for overtime pay)." Add Workplace: "Workplace type: Office, with flexible work arrangement options (in‑office and remote) as determined by the hiring team." Combine into one or two paragraphs. Now Responsibilities:

Responsibilities

• ... each responsibility. We need to ensure we include "Performs other duties as assigned." as a liability. Now Requirements:

  Requirements

  • Bachelor's degree or equivalent level of work experience
  • Five or more years relevant experience in a technology role, directly supporting technology processes or assets (applications/systems/etc.)
  Qualifications:

  Qualifications

  • Previous experience serving in a Governance/Risk/Compliance/Audit function, ideally in a leadership role and with a large firm
  • Effective advisory and collaboration skills, and ability to drive consensus
  • Advanced understanding of the IT process’ (developing, delivering, supporting technology) and associated grasp of Technology Risks and Controls
  • Logical and organized problem solver
  • Effective written and verbal communication skills. Resource needs to be effective at understanding the technical side but also able to document their assessment (or other analysis items as needed).
  • Critical/strategic thinker (able to look at something strategically and think risk, efficiency, cost, etc. – big picture ‘so what’ analysis and can execute what’s needed to help support the effort)
  • Process oriented mindset and able to tell a story leveraging data
  • Time management/organized/ability to prioritize
  • Managerial courage and ability to effectively interact with various levels of leadership
  • Understanding of IT risk and control frameworks such as COBIT, etc.
  • In-depth knowledge of risk management processes and principles, including experience assessing risks, analyzing testing results and developing remediation plans
  • Strong preference for recognized industry certification such as ISACA CRISC/CISA/CISM, ISC2 CISSP/SSCP, or similar. Where these certifications are not possessed at the time of hire, the candidate will be expected to obtain certification