Technology Risk & Control

Role Summary

The Portfolio Governance Lead provides centralized governance and execution oversight across a portfolio of Market applications, ensuring technology risk, control remediation, regulatory commitments, and strategic remediation initiatives are effectively managed and reported.

The role maintains the integrated portfolio view, drives governance cadence, manages RAID and escalation processes, and provides senior leadership with clear visibility into material risk exposure, remediation progress, emerging concerns, dependencies, and decisions required.

Key Responsibilities

Portfolio Governance

• Maintain the integrated Risk & Control portfolio across 500+ applications.
• Establish consistent governance standards, reporting requirements, milestones, and escalation criteria.
• Coordinate activities across Risk Remediation Project Managers, application owners, cybersecurity, infrastructure, IAM, third-party risk, audit, and control teams.
• Ensure priority risks have a clear accountable owner, path to green, target date, milestones, dependencies, and closure criteria. These fields align with the portfolio operating model already established in Application_Risk_and_Vulnerability_Operating_Model.docx. [Applicatio...ting_Model | Word]

Executive Reporting

• Produce concise executive dashboards and portfolio-level reporting covering:
  • Material risk exposure
  • P1/P2 and overdue remediation
  • Aging risks and control gaps
  • Milestone slippage
  • Forecast confidence
  • Regulatory and audit commitments
  • Vendor/platform dependencies
  • Decisions and executive intervention required
• Translate detailed remediation activity into clear senior-management reporting focused on exposure, trajectory, accountability, and required decisions.

RAID & Dependency Management

• Maintain the portfolio-level Risks, Actions, Issues and Dependencies (RAID) framework.
• Identify systemic or cross-application risks that cannot be resolved within individual workstreams.
• Track dependencies involving shared infrastructure, cybersecurity, IAM, vendors, funding, resources, and technology platforms.
• Drive accountability for overdue actions and unresolved blockers.

Escalation Management

• Establish clear escalation thresholds for material exposure, missed commitments, regulatory deadlines, inadequate remediation plans, and unresolved dependencies.
• Escalate issues through the appropriate risk and technology governance forums.
• Ensure escalations clearly state business/risk impact, accountable owner, corrective action, target date, blocker, and decision required.

Governance Calendar

Own and coordinate the Risk & Control governance cadence, including:

• Daily: Critical/P1 exception management
• Weekly: Portfolio remediation and execution review
• Biweekly: High-risk and control-domain reviews
• Monthly: Risk & Control Remediation Council
• Quarterly: Executive portfolio and operating-model review

This cadence is consistent with the governance structure established in Application_Risk_Vulnerability_Executive_Operating_Model.pptx. [Applicatio...ting_Model | PowerPoint]

Remediation & Closure Oversight

• Challenge remediation plans that lack credible milestones, ownership, dependencies, or target dates.
• Monitor delivery against agreed paths to green.
• Coordinate with control owners to ensure remediation evidence supports closure.
• Ensure items are not reported as closed until required evidence and validation are complete.

Key Deliverables

• Enterprise application Risk & Control portfolio dashboard
• Executive monthly reporting
• Integrated RAID and dependency register
• Governance calendar
• Decision and escalation log
• Remediation milestone reporting
• Aging and overdue-risk reporting
• Regulatory/audit commitment tracking
• Portfolio-level risk heatmaps
• Executive briefing materials

Experience & Skills

• 7+ years of experience in technology risk, program/project management, cybersecurity, infrastructure, audit, controls, or technology governance.
• Experience managing large technology portfolios in a regulated environment.
• Strong understanding of risk remediation, IAM/PAM, vulnerability management, infrastructure risk, third-party risk, audit, and regulatory commitments.
• Strong executive communication and presentation skills.
• Demonstrated ability to drive accountability across teams without necessarily having direct management authority.
• Strong experience with RAID management, portfolio reporting, governance forums, dependency management, and executive escalation.
• PMP, PRINCE2, Agile, ITIL, risk, or related professional certification preferred.

Success Measures

Success should be measured by risk outcomes rather than number of applications administered, including:

• Reduction in aged and overdue risks
• Percentage of priority issues with credible paths to green
• Reduction in missed remediation commitments
• Timeliness of escalations
• Closure evidence quality
• Forecast accuracy
• Reduction in risks without accountable owners
• Timely resolution of cross-team dependencies
• Quality and accuracy of executive reporting

Salary Range:

The range quoted above applies to the role in the primary location specified. If the candidate would ultimately work outside of the primary location above, the applicable range could differ.

Employees are eligible to participate in State Street’s comprehensive benefits program, which includes: our retirement savings plan (401K) with company match; insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages; paid-time off including vacation, sick leave, short term disability, and family care responsibilities; access to our Employee Assistance Program; incentive compensation including eligibility for annual performance-based awards (excluding certain sales roles subject to sales incentive plans); and, eligibility for certain tax advantaged savings plans.

For a full overview, visit https://hrportal.ehr.com/statestreet/Home.

About State Street

Across the globe, institutional investors rely on us to help them manage risk, respond to challenges, and drive performance and profitability. We keep our clients at the heart of everything we do, and smart, engaged employees are essential to our continued success.

We are committed to fostering an environment where every employee feels valued and empowered to reach their full potential. As an essential partner in our shared success, you’ll benefit from inclusive development opportunities, flexible work-life support, paid volunteer days, and vibrant employee networks that keep you connected to what matters most. Join us in shaping the future.

As an Equal Opportunity Employer, we consider all qualified applicants for all positions without regard to race, creed, color, religion, national origin, ancestry, ethnicity, age, disability, genetic information, sex, sexual orientation, gender identity or expression, citizenship, marital status, domestic partnership or civil union status, familial status, military and veteran status, and other characteristics protected by applicable law.

Discover more information on jobs at StateStreet.com/careers

Read our CEO Statement

Job Application Disclosure:

It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.