Corporate Vice President - HR Process Risk Assurance & Compliance

The CVP, HR Process Risk Assurance & Compliance is responsible for HR process reviews, risk and controls, and quality assurance, which includes policy and procedure adoption and effectiveness, and ensures that organizational standards, governance and practices have been designed and implemented to mitigate risks within HR.

Main responsibilities include:

• Development and mapping of operational risk and controls catalog for transparency into policy and procedure adoption and risk remediation.
• Implementation and execution of a risk management program primarily related to quality assurance / self-assessments of operational and system application controls, end user computing (EUC) controls and third-party service provider (TPSP) controls.
• Conduct process and system implementation assurance and optimization, which includes pre / post go-live assessments to ensure process effectiveness.
• Accountable for coordinating with internal business units to determine impact of external dependencies on HR processes.
• Track and report on operational and technology controls testing and deficiencies while adhering to timeline and milestones.
• Review remediation strategies to address operational, financial, IT general controls, application, EUC and TPSP control failures impacting HR processes.
• Aggregate and compile assessments results which will be leveraged for executive presentations on the state of the control environment.
• Assist HR in presentation to senior/executive management on the state of risk management activities.
• Educate business process and control owners throughout the organization on risk and control leading practices through formal trainings and informal dialogue.
• Establishment and execution of risk assurance processes including reporting and dashboarding.
• Aid in the on-going development of New York Life’s MAR/SOX standards, governance, training, and practices.

Required qualifications:

• Bachelor's Degree with credits in Accounting, Finance, Management Information Systems, and/or Computer Science
• 6-8 years of experience in risk management and reporting
• CISSP, CISM, CRISC, CISA preferred
• Strong knowledge of service organization controls reports (e.g., operational, IT and financial) is required
• Understanding of key industry control frameworks (NIST Cyber Security Framework, COSO, COBIT, ISO 27000, etc.)
• Moderate level knowledge and understanding of systems architecture, infrastructure, security and applications
• Experience in planning, organizing, and conducting detailed risk and control reviews
• Experience in performing and documenting business and technology process walkthroughs
• Experience in creating testing procedures and documenting substantive testing performed
• Prior experience performing application and infrastructure layer control assessments
• Ability to interpret and understand business and technology policies and standards
• Ability to implement the risk and controls assessment and advisory strategy
• Strong interpersonal, oral and written communications, and organizational skills to effectively work closely with technology stakeholders across the organization
• Ability to communicate complex risk assessment information to non-technical business leaders to ensure they comprehend the risk owned by them and steps required for remediation
• Able to effectively communicate evaluation of risk remediation plans to action plan owners to ensure that mitigation activities are appropriately addressed
• Demonstrated leadership and ability to manage and supervise staff/consultants in a highly productive environment