Sr. Risk Manager, Cyber & Technology Risk Management
Brown Brothers Harriman · Jersey City, NJ · 1 mo ago
Hybrid$140k–$190k/yrFull-time
We need to output HTML fragment with sections: About the role, Responsibilities, Requirements (or Qualifications), Benefits, Pay, Schedule etc. Must only include sections with real content. Remove boilerplate like EEO, navigation, etc. Must not repeat job title as heading. Must not include Job ID. Must preserve all substantive info.
We need to parse the posting.
Key sections:
- Intro paragraph about BBH, partnership, etc. Could be "About the role" maybe? Actually "About the role" heading is for description of role. The intro includes description of Cyber & Technology Risk Management group and role. Could be placed under "About the role". We'll include that.
- Responsibilities: bullet list under "Responsibilities". The posting has "Responsibilities What You’ll Do" then bullet points (starting with "Partner with technology..." etc). We'll extract each bullet.
- Qualifications: bullet list under "Qualifications". The posting has "Qualifications What You’ll Bring" then bullet points (starting with "Bachelor’s degree..." etc). We'll extract each bullet.
- Pay: The posting includes "Salary Range NJ / MA: $140,000 - $190,000 base salary + annual target bonus" and further explanation about base salary etc. So we have Pay section.
- Benefits: The posting includes paragraph about total rewards package: "BBH and its affiliates' compensation program includes base salary, discretionary bonuses, and profit-sharing. ... BBH's total rewards package recognizes your contributions with more than just a paycheck—providing you with benefits that enhance your experience at BBH from long-term savings, healthcare, and income protection to professional development opportunities and time off, our programs support your overall well-being." Also later: "Go to BBH.com to learn more about our rewards and benefits, philanthropy, approach to sustainability or how we support you to thrive personally, physically and financially." That's benefits info. So we can include Benefits section.
- Schedule: The posting includes "This role can be based in either our Boston or Jersey City locations and will be a hybrid role, with a minimum of three (3) days in office." That's schedule/location info. Could be under Schedule or maybe under "About the role"? But we have a Schedule heading for hybrid schedule. We'll include Schedule section.
- About BBH: There's a paragraph about BBH description. Could be under "About BBH" but we only have allowed headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. The instruction says use for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can use About the role, Responsibilities, Qualifications (maybe Requirements is similar to Qualifications). We have both Qualifications and Requirements? The posting has "Qualifications What You’ll Bring". We'll treat that as Qualifications. Could also have Requirements but we can skip if duplicate. We'll include Qualifications.
- Skills: Not explicitly separate; qualifications include skills. Could omit Skills section if no specific skills list beyond qualifications. Better to omit.
Thus sections: About the role, Responsibilities, Qualifications, Pay, Benefits, Schedule.
We must not include filler like "commensurate with experience". Not present.
We must preserve all substantive info. Ensure we don't lose any details.
Let's extract About the role content: The intro paragraphs before "Responsibilities". Let's capture:
"At BBH, Partnership is more than a form of ownership—it’s our approach to business and relationships. We know that supporting your professional and personal goals is the best way to help our clients and advance our business. We take that responsibility seriously. With a 200-year legacy and a shared passion for what’s next, this is the right place to build a fulfilling career. Cyber & Technology Risk Management is an independent second-line risk function within Enterprise Risk Management (ERM). The group is aligned to the Firm’s global Systems/Technology organization and provides risk oversight across a complex financial services environment. The Senior Risk Manager will serve as a trusted second-line advisor, leading a team of cyber and technology risk professionals responsible for identifying, assessing, and helping manage cyber and technology risks that impact the Firm. The Senior Risk Manager is expected to bring broad technical knowledge with expertise in cyber risk management and related regulatory frameworks including information security, cyber resilience, data protection, and regulatory compliance across the Firm's technology environment. This is a senior, highly visible role that partners closely with Systems/Technology management, Application and Data Owners, control owners, Compliance, Internal Audit, Line of Business leadership, and peer leaders across Cyber & Technology Risk Management and ERM to promote sound risk decisions, strong governance, and practical outcomes."
That's the About the role.
Now Responsibilities bullet list:
- Partner with technology, security, and operations teams to identify, assess, and manage cyber and technology risks.
- Provide independent second-line advisory and effective challenge, translating risk considerations into clear, practical guidance.
- Lead and/or support risk and control assessments, including cyber risk reviews, RCSAs, application risk assessments, external assurance reviews, and related governance activities.
- Evaluate control gaps, risk acceptances, exceptions, and remediation plans; assist stakeholders prioritize actions based on business impact, risk appetite, and regulatory expectations.
- Analyze new and emerging risks, including related regulatory requirements and supervisory guidance to identify risk implications and potential gaps; collaborate with control owners on control design, implementation, and measurement.
- Support the continued build-out of a new IT governance platform to improve integration, transparency, and execution across Cyber & Technology Risk Management programs.
Now Qualifications bullet list:
- Bachelor’s degree, equivalent work experience, specialized training in information technology, cybersecurity, risk management, audit, or related discipline.
- 10+ years of experience in cyber risk, technology risk, information security, IT audit, operational risk, third-party risk, or a related control function.
- Demonstrated experience assessing cyber risk programs, cybersecurity controls, and information security governance frameworks within a regulated financial institution or similarly regulated environment.
- Ability to analyze complex risk issues, balance business objectives with control expectations, and communicate practical recommendations to both technical and non-technical audiences.
- Strong understanding of cyber and technology risk concepts, control assessment, issue management, remediation tracking, risk acceptance, and risk reporting practices.
- Strong knowledge of cybersecurity regulatory requirements and industry frameworks, including NYDFS Part 500, NIST Cybersecurity Framework, ISO 27001, and other applicable cybersecurity or operational resilience standards.
- Familiarity with DORA, global operational resilience requirements, and other emerging cyber regulatory frameworks.
- Working knowledge of technology environments, including networks, operating platforms, cloud services, application security, and third-party hosted solutions.
- Certifications such as CISSP, CISM, and/or CRISC are a plus.
Now Pay section: The posting includes:
"This role can be based in either our Boston or Jersey City locations and will be a hybrid role, with a minimum of three (3) days in office." That's schedule.
Salary: "Salary Range NJ / MA: $140,000 - $190,000 base salary + annual target bonus BBH and its affiliates' compensation program includes base salary, discretionary bonuses, and profit-sharing. The anticipated base salary range(s) shown above are only for the indicated location(s) and may differ in other locations due to cost of living and labor considerations. Base salaries may vary based on factors such as skill, experience and qualification for the role."
We'll combine into Pay section.
Benefits section: The posting includes:
"BBH's total rewards package recognizes your contributions with more than just a paycheck—providing you with benefits that enhance your experience at BBH from long-term savings, healthcare, and income protection to professional development opportunities and time off, our programs support your overall well-being."
Also earlier: "BBH and its affiliates' compensation program includes base salary, discretionary bonuses, and profit-sharing." That's more compensation but could be part of Pay. But we already have Pay. Benefits: we can include the total rewards package description.
Also later: "Go to BBH.com to learn more about our rewards and benefits, philanthropy, approach to sustainability or how we support you to thrive personally, physically and financially." That's more benefits but we can keep.
We'll combine into Benefits section.
Schedule section: hybrid role, min 3 days in office, locations Boston or Jersey City.
Now we need to output HTML fragment with
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can use About the role, Responsibilities, Qualifications (maybe Requirements is similar to Qualifications). We have both Qualifications and Requirements? The posting has "Qualifications What You’ll Bring". We'll treat that as Qualifications. Could also have Requirements but we can skip if duplicate. We'll include Qualifications.
- Skills: Not explicitly separate; qualifications include skills. Could omit Skills section if no specific skills list beyond qualifications. Better to omit.
Thus sections: About the role, Responsibilities, Qualifications, Pay, Benefits, Schedule.
We must not include filler like "commensurate with experience". Not present.
We must preserve all substantive info. Ensure we don't lose any details.
Let's extract About the role content: The intro paragraphs before "Responsibilities". Let's capture:
"At BBH, Partnership is more than a form of ownership—it’s our approach to business and relationships. We know that supporting your professional and personal goals is the best way to help our clients and advance our business. We take that responsibility seriously. With a 200-year legacy and a shared passion for what’s next, this is the right place to build a fulfilling career. Cyber & Technology Risk Management is an independent second-line risk function within Enterprise Risk Management (ERM). The group is aligned to the Firm’s global Systems/Technology organization and provides risk oversight across a complex financial services environment. The Senior Risk Manager will serve as a trusted second-line advisor, leading a team of cyber and technology risk professionals responsible for identifying, assessing, and helping manage cyber and technology risks that impact the Firm. The Senior Risk Manager is expected to bring broad technical knowledge with expertise in cyber risk management and related regulatory frameworks including information security, cyber resilience, data protection, and regulatory compliance across the Firm's technology environment. This is a senior, highly visible role that partners closely with Systems/Technology management, Application and Data Owners, control owners, Compliance, Internal Audit, Line of Business leadership, and peer leaders across Cyber & Technology Risk Management and ERM to promote sound risk decisions, strong governance, and practical outcomes."
That's the About the role.
Now Responsibilities bullet list:
- Partner with technology, security, and operations teams to identify, assess, and manage cyber and technology risks.
- Provide independent second-line advisory and effective challenge, translating risk considerations into clear, practical guidance.
- Lead and/or support risk and control assessments, including cyber risk reviews, RCSAs, application risk assessments, external assurance reviews, and related governance activities.
- Evaluate control gaps, risk acceptances, exceptions, and remediation plans; assist stakeholders prioritize actions based on business impact, risk appetite, and regulatory expectations.
- Analyze new and emerging risks, including related regulatory requirements and supervisory guidance to identify risk implications and potential gaps; collaborate with control owners on control design, implementation, and measurement.
- Support the continued build-out of a new IT governance platform to improve integration, transparency, and execution across Cyber & Technology Risk Management programs.
Now Qualifications bullet list:
- Bachelor’s degree, equivalent work experience, specialized training in information technology, cybersecurity, risk management, audit, or related discipline.
- 10+ years of experience in cyber risk, technology risk, information security, IT audit, operational risk, third-party risk, or a related control function.
- Demonstrated experience assessing cyber risk programs, cybersecurity controls, and information security governance frameworks within a regulated financial institution or similarly regulated environment.
- Ability to analyze complex risk issues, balance business objectives with control expectations, and communicate practical recommendations to both technical and non-technical audiences.
- Strong understanding of cyber and technology risk concepts, control assessment, issue management, remediation tracking, risk acceptance, and risk reporting practices.
- Strong knowledge of cybersecurity regulatory requirements and industry frameworks, including NYDFS Part 500, NIST Cybersecurity Framework, ISO 27001, and other applicable cybersecurity or operational resilience standards.
- Familiarity with DORA, global operational resilience requirements, and other emerging cyber regulatory frameworks.
- Working knowledge of technology environments, including networks, operating platforms, cloud services, application security, and third-party hosted solutions.
- Certifications such as CISSP, CISM, and/or CRISC are a plus.
Now Pay section: The posting includes:
"This role can be based in either our Boston or Jersey City locations and will be a hybrid role, with a minimum of three (3) days in office." That's schedule.
Salary: "Salary Range NJ / MA: $140,000 - $190,000 base salary + annual target bonus BBH and its affiliates' compensation program includes base salary, discretionary bonuses, and profit-sharing. The anticipated base salary range(s) shown above are only for the indicated location(s) and may differ in other locations due to cost of living and labor considerations. Base salaries may vary based on factors such as skill, experience and qualification for the role."
We'll combine into Pay section.
Benefits section: The posting includes:
"BBH's total rewards package recognizes your contributions with more than just a paycheck—providing you with benefits that enhance your experience at BBH from long-term savings, healthcare, and income protection to professional development opportunities and time off, our programs support your overall well-being."
Also earlier: "BBH and its affiliates' compensation program includes base salary, discretionary bonuses, and profit-sharing." That's more compensation but could be part of Pay. But we already have Pay. Benefits: we can include the total rewards package description.
Also later: "Go to BBH.com to learn more about our rewards and benefits, philanthropy, approach to sustainability or how we support you to thrive personally, physically and financially." That's more benefits but we can keep.
We'll combine into Benefits section.
Schedule section: hybrid role, min 3 days in office, locations Boston or Jersey City.
Now we need to output HTML fragment with headings and - for lists,
for prose.
We must not include any extra markup like or . Just the fragment.
We'll produce:
About the role
... (the paragraph)
Responsibilities
- ...
...
Qualifications
- ...
...
Pay
... (salary range and compensation details)
Benefits
... (total rewards package)
Schedule
... (hybrid, location)
Check for any duplicated lines: Ensure we didn't include boilerplate like EEO etc. We excluded.
Check for any placeholders: none.
Now craft the exact text.
About the role paragraph: Ensure we keep exactly as in posting, but we can trim extra spaces. We'll copy the paragraph.
Let's copy:
"At BBH, Partnership is more than a form of ownership—it’s our approach to business and relationships. We know that supporting your professional and personal goals is the best way to help our clients and advance our business. We take that responsibility seriously. With a 200-year legacy and a shared passion for what’s next, this is the right place to build a fulfilling career. Cyber & Technology Risk Management is an independent second-line risk function within Enterprise Risk Management (ERM). The group is aligned to the Firm’s global Systems/Technology organization and provides risk oversight across a complex financial services environment. The Senior Risk Manager will serve as a trusted second-line advisor, leading a team of cyber and technology risk professionals responsible for identifying, assessing, and helping manage cyber and technology risks that impact the Firm. The Senior Risk Manager is expected to bring broad technical knowledge with expertise in cyber risk management and related regulatory frameworks including information security, cyber resilience, data protection, and regulatory compliance across the Firm's technology environment. This is a senior, highly visible role that partners closely with Systems/Technology management, Application and Data Owners, control owners, Compliance, Internal Audit, Line of Business leadership, and peer leaders across Cyber & Technology Risk Management and ERM to promote sound risk decisions, strong governance, and practical outcomes."
Now Responsibilities bullets exactly as in posting:
- Partner with technology, security, and operations teams to identify, assess, and manage cyber and technology risks.
- Provide independent second-line advisory and effective challenge, translating risk considerations into clear, practical guidance.
- Lead and/or support risk and control assessments, including cyber risk reviews, RCSAs, application risk assessments, external assurance reviews, and related governance activities.
- Evaluate control gaps, risk acceptances, exceptions, and remediation plans; assist stakeholders prioritize actions based on business impact, risk appetite, and regulatory expectations.
- Analyze new and emerging risks, including related regulatory requirements and supervisory guidance to identify risk implications and potential gaps; collaborate with control owners on control design, implementation, and measurement.
- Support the continued build-out of a new IT governance platform to improve integration, transparency, and execution across Cyber & Technology Risk Management programs.
Now Qualifications bullets:
- Bachelor’s degree, equivalent work experience, specialized training in information technology, cybersecurity, risk management, audit, or related discipline.
- 10+ years of experience in cyber risk, technology risk, information security, IT audit, operational risk, third-party risk, or a related control function.
- Demonstrated experience assessing cyber risk programs, cybersecurity controls, and information security governance frameworks within a regulated financial institution or similarly regulated environment.
- Ability to analyze complex risk issues, balance business objectives with control expectations, and communicate practical recommendations to both technical
- for lists,
for prose. We must not include any extra markup like or . Just the fragment. We'll produce:
About the role
... (the paragraph)
Responsibilities
- ... ...
Qualifications
- ... ...
Pay
... (salary range and compensation details)
Benefits
... (total rewards package)
Schedule
... (hybrid, location)
Check for any duplicated lines: Ensure we didn't include boilerplate like EEO etc. We excluded. Check for any placeholders: none. Now craft the exact text. About the role paragraph: Ensure we keep exactly as in posting, but we can trim extra spaces. We'll copy the paragraph. Let's copy: "At BBH, Partnership is more than a form of ownership—it’s our approach to business and relationships. We know that supporting your professional and personal goals is the best way to help our clients and advance our business. We take that responsibility seriously. With a 200-year legacy and a shared passion for what’s next, this is the right place to build a fulfilling career. Cyber & Technology Risk Management is an independent second-line risk function within Enterprise Risk Management (ERM). The group is aligned to the Firm’s global Systems/Technology organization and provides risk oversight across a complex financial services environment. The Senior Risk Manager will serve as a trusted second-line advisor, leading a team of cyber and technology risk professionals responsible for identifying, assessing, and helping manage cyber and technology risks that impact the Firm. The Senior Risk Manager is expected to bring broad technical knowledge with expertise in cyber risk management and related regulatory frameworks including information security, cyber resilience, data protection, and regulatory compliance across the Firm's technology environment. This is a senior, highly visible role that partners closely with Systems/Technology management, Application and Data Owners, control owners, Compliance, Internal Audit, Line of Business leadership, and peer leaders across Cyber & Technology Risk Management and ERM to promote sound risk decisions, strong governance, and practical outcomes." Now Responsibilities bullets exactly as in posting: - Partner with technology, security, and operations teams to identify, assess, and manage cyber and technology risks. - Provide independent second-line advisory and effective challenge, translating risk considerations into clear, practical guidance. - Lead and/or support risk and control assessments, including cyber risk reviews, RCSAs, application risk assessments, external assurance reviews, and related governance activities. - Evaluate control gaps, risk acceptances, exceptions, and remediation plans; assist stakeholders prioritize actions based on business impact, risk appetite, and regulatory expectations. - Analyze new and emerging risks, including related regulatory requirements and supervisory guidance to identify risk implications and potential gaps; collaborate with control owners on control design, implementation, and measurement. - Support the continued build-out of a new IT governance platform to improve integration, transparency, and execution across Cyber & Technology Risk Management programs. Now Qualifications bullets: - Bachelor’s degree, equivalent work experience, specialized training in information technology, cybersecurity, risk management, audit, or related discipline. - 10+ years of experience in cyber risk, technology risk, information security, IT audit, operational risk, third-party risk, or a related control function. - Demonstrated experience assessing cyber risk programs, cybersecurity controls, and information security governance frameworks within a regulated financial institution or similarly regulated environment. - Ability to analyze complex risk issues, balance business objectives with control expectations, and communicate practical recommendations to both technical