Overview

Executes independent control testing and remediation validation activities across Technology, Cybersecurity, and Data domains. Partners with Risk Advisors, Risk Owners, and Control Owners to assess control design and operating effectiveness, identify control gaps, and validate remediation efforts. Supports risk management activities through testing execution, issue evaluation, reporting, and ongoing enhancement of the control testing program.

Primary Responsibilities

• Support execution of the Annual Controls Testing Plan by completing assigned testing engagements and contributing to risk-based testing coverage across Technology, Cybersecurity, and Data risk domains.
• Partner with Risk Advisors, Risk Owners, Control Owners, and Process Owners to understand risks, control objectives, and processes, and identify testing attributes and required evidence.
• Assess control design and operating effectiveness in accordance with established testing methodologies, procedures, standards, and quality assurance requirements to determine whether controls are appropriately designed and operating effectively.
• Identify control deficiencies, documentation gaps, and opportunities for improvement, and communicate observations to stakeholders in a clear and professional manner.
• Evaluate remediation activities and supporting evidence to determine whether identified issues, audit findings, regulatory matters, and control deficiencies have been effectively addressed.
• Document testing procedures, results, conclusions, and supporting evidence in accordance with established testing standards and documentation requirements.
• Assist with preparation and response to regulatory engagements, including gathering documentation, coordinating evidence requests, and supporting exam management activities.
• Prepare summaries of testing results, observations, remediation status, and emerging themes for management reporting.
• Contribute to continuous improvement efforts by identifying opportunities to enhance testing methodologies, procedures, reporting, and quality assurance practices.
• Understand and adhere to the Company's risk and regulatory standards, policies, and controls in accordance with the Company's Risk Appetite. Identify risk-related issues requiring escalation to management.
• Promote an environment that supports diversity and reflects the M&T Bank brand.
• Complete other related duties as assigned.

Scope of Responsibilities

• Primarily interacts with senior leaders within Technology and Cybersecurity, senior people leaders, and internal partners such as the Risk Division and Internal Audit.
• Works with general guidance and established procedures, exercising judgment in applying testing methodologies, evaluating evidence, and developing conclusions.
• Applies professional judgment in determining testing approaches, sample selections, issue evaluations, and remediation validation activities for assigned engagements.
• Identifies and communicates control gaps, risk concerns, and process improvement opportunities to management and stakeholders.
• Develops working knowledge of control testing methodology, control design assessment, operating effectiveness testing, issue management, and remediation validation practices.
• Prepares management reporting on testing results, thematic observations, control environment maturity, remediation status, and emerging risk trends.
• May participate in regulatory examinations, audits, and risk management reviews under the direction of senior Technology and Cybersecurity Risk leaders.

Supervisory/Managerial Responsibilities

No supervisory responsibilities.

Education and Experience Required

• Bachelor's degree and a minimum of 3 years' relevant work experience, or in lieu of a degree, a combined minimum of 7 years' higher education and/or work experience.
• Demonstrated proficient knowledge of Technology and/or Cybersecurity risk principles.
• Minimum of 2 years' relevant work experience in or with risk, audit, technology, cybersecurity, or a related area.
• Knowledge of cybersecurity principles and industry best practices relevant to confidentiality, integrity, and availability.
• Experience meeting strict deadlines.

Education and Experience Preferred

• Applicable certification aligned to the function or domain, such as: Certified in Risk and Information Systems Control (CRISC®) Certified Information Systems Auditor (CISA) Certified Information Security Manager (CISM) Certified Information Systems Security Professional (CISSP)
• Proficient critical thinking and problem-solving skills.
• Excellent written and verbal communication skills.
• Experience collaborating with peers and leadership to deliver results.
• Demonstrated curiosity, with the ability to seek critical information and apply learnings.
• Ability to adapt seamlessly to changing priorities and deliver results aligned with business needs.
• Experience gaining buy-in from others to align on processes.

Location