Make banking a Fifth Third better®
We connect great people to great opportunities. Are you ready to take the next step? Discover a career in banking at Fifth Third Bank.

Business Controls – Privacy Risk & Compliance

GENERAL FUNCTION

As a first line of defense, provides specialized Business Controls support focused on identifying, assessing, mitigating, monitoring, and managing privacy, information protection, and regulatory risks, with particular emphasis on the Gramm-Leach-Bliley Act (GLBA) and Payment Card Industry Data Security Standard (PCI DSS).

Responsible for coordinating and conducting GLBA Risk Assessments, supporting PCI Report on Compliance (ROC) efforts across applicable lines of business, and planning and executing internal PCI assessments. Partners with lines of business to evaluate privacy and data protection risks, assess the design and effectiveness of controls, identify gaps, and support the development and implementation of appropriate remediation.

Serves as a subject matter expert for GLBA, PCI, and related privacy risk and control requirements, providing guidance to business partners and working closely with Legal, Compliance, Enterprise Risk, Information Security, Technology, Audit, and other key stakeholders. Monitors changes in applicable laws, regulations, standards, and regulatory guidance and assists the business in understanding and incorporating those requirements into business processes and controls.

Supports Business Controls in advancing privacy risk management practices, processes, assessments, reporting, and tools within the organization's Enterprise Risk Management (ERM) framework. Develops and presents meaningful risk information and insights to stakeholders to support informed decision-making and effective management of privacy and data protection risks.

Responsible and accountable for risk by openly exchanging ideas and opinions, elevating privacy, security, and control concerns, and following established policies and procedures. Operates within the Bank's and lines of business' established risk appetites while consistently identifying, assessing, managing, monitoring, and reporting privacy, data protection, and related operational risks.

ESSENTIAL DUTIES AND RESPONSIBILITIES

• Leads and coordinates GLBA Risk Assessments for applicable lines of business, including identification and evaluation of privacy and information protection risks, controls, potential gaps, and remediation needs.
• Supports the organization's PCI Report on Compliance (ROC) activities across applicable lines of business, including coordination of assessment activities, evidence collection, control validation, documentation, and engagement with business stakeholders and the external Qualified Security Assessor (QSA).
• Plans, coordinates, and executes internal PCI assessments to evaluate compliance with applicable PCI DSS requirements and the effectiveness of associated business processes and controls.
• Serves as a Business Controls subject matter expert for GLBA, PCI, and related privacy and data protection requirements, providing guidance and interpretation to lines of business and other stakeholders.
• Partners with business leadership to develop and implement controls, policies, procedures, and sustainable processes designed to effectively manage privacy, GLBA, PCI, and data protection risks.
• Provides expertise and analysis related to the identification, assessment, control, monitoring, testing, and reporting of privacy and information protection risks.
• Evaluates business processes involving the collection, use, storage, transmission, sharing, retention, and protection of sensitive information to identify potential privacy, GLBA, and PCI-related risks and control gaps.
• Maintains awareness of evolving privacy laws, GLBA requirements, PCI DSS standards, regulatory guidance, and industry practices, and assists in evaluating their applicability and potential impact to business processes and controls.
• Supports regulatory change management activities related to privacy, GLBA, PCI, and information protection requirements to help ensure applicable changes are identified, assessed, communicated, and incorporated into business practices.
• Identifies control breakdowns, inadequate processes, and unexpected events involving privacy or protected information and partners with Business Controls leadership and lines of business to develop appropriate corrective actions.
• Supports the resolution of privacy, GLBA, PCI, information-security, Audit, Compliance, and Risk Management issues, including identification of root causes and development and monitoring of remediation activities.
• Partners with lines of business to establish appropriate business ownership of privacy-related processes, risks, controls, assessments, testing, and remediation activities.
• Builds effective relationships with Legal, Compliance, Enterprise Risk, Information Security, Technology, Audit, other Business Controls organizations, and lines of business to promote consistent interpretation and execution of privacy and data protection requirements.
• Provides guidance related to appropriate controls for protecting sensitive information and supports efforts to ensure information is handled in accordance with applicable privacy, GLBA, PCI, and internal policy requirements.
• Supports RCSA and other ERM processes by helping identify and assess privacy and information protection risks and controls, including evaluation of inherent and residual risk where applicable.
• Partners with lines of business and Risk partners to identify appropriate risk indicators, thresholds, monitoring activities, and reporting related to privacy, GLBA, PCI, and information protection risks.
• Supports issue management and remediation activities involving privacy or payment-card information, including root cause analysis, corrective action development, documentation, escalation, and monitoring through resolution.
• Evaluates privacy and information-protection considerations associated with third-party and supplier relationships where applicable, including identification of potential GLBA and PCI impacts and associated controls.
• Provides privacy and regulatory risk expertise for new products, processes, technology implementations, business changes, and other initiatives that may affect the collection, management, transmission, or protection of customer or payment-card information.
• Gathers and analyzes assessment results, control information, issues, and other risk data to identify trends, recurring control weaknesses, and opportunities to strengthen the organization's privacy and data protection control environment.
• Develops and presents clear and actionable reporting regarding GLBA assessments, PCI compliance activities, privacy risks, control gaps, issues, and remediation efforts to Business Controls leadership and other stakeholders.
• Maintains complete and accurate assessment documentation and supports appropriate recordkeeping within applicable governance, risk, and compliance systems.
• Participates in special initiatives involving privacy, GLBA, PCI, information protection, regulatory requirements, or emerging risk, as assigned by Business Controls or line-of-business leadership.

At Fifth Third, we understand the importance of recognizing our employees for the role they play in improving the lives of our customers, communities and each other. Our Total Rewards include comprehensive benefits and differentiated compensation offerings to give each employee the opportunity to be their best every day.

The base salary for this position is reflective of the range of salary levels for all roles within this pay grade across the U.S. Individual salaries within this range will vary based on factors such as role, relevant skillset, relevant experience, education and geographic location. In addition to the base salary, this role is eligible to participate in an incentive compensation plan, with any such payment based upon company, line of business and/or individual performance.

Our extensive benefits programs are designed to support the individual needs of our employees and their families, encompassing physical, financial, emotional and social well-being. You can learn more about those programs on our 53.com Careers page at: https://www.53.com/content/fifth-third/en/careers/benefits.html or by consulting with your talent acquisition partner. 

Attention search firms and staffing agencies: do not submit unsolicited resumes for this posting.  Fifth Third does not accept resumes from any agency that does not have an active agreement with Fifth Third.  Any unsolicited resumes – no matter how they are submitted – will be considered the property of Fifth Third and Fifth Third will not be responsible for any associated fee.

Fifth Third Bank, National Association is proud to have an engaged and inclusive culture and to promote and ensure equal employment opportunity in all employment decisions regardless of race, color, gender, national origin, religion, age, disability, sexual orientation, gender identity, military status, veteran status or any other legally protected status.