Oversees key risks, threats, controls, and other critical technology risk management functions supporting FFIO, as well as supports the launch of innovative new products and offerings. Provides independent and objective audit and advisory services that help FFIO manage risk, improves customer service, and enhances business performance. Performs complex technology and/or business-integrated audits. Develops hypotheses around risk and controls, provides input to the development of the integrated audit plan, and collaborates with application teams. Leverages audit automation tools in the evaluation of business operations and systems., * Defines, manages, and implements the program scope, objectives, and deliverables to ensure alignment with organizational goals.

• Leads technology risk assessments and issue mitigation/tracking for all aspects.

• Understands workflow technology and end-to-end related processes, highlighting risks and controls embedded throughout the function.

• Helps the business build control programs that appropriately mitigate risk and meet corporate standards.

• Partners with business and technology leaders to promote a collaborative environment that helps the business meet its goals while ensuring it stays within its risk tolerance.

• Applies strategic data analytics concepts, principles, and techniques to efficiently and effectively identify control deficiencies.

• Drafts audit reports that provide a clear description of issues identified, related implications to the business or enterprise as a whole, and management action plans to resolve the issues.

Bachelor’s degree in Computer Science, Engineering, Information Technology, Information Systems, Information Management, Technology Management, or a closely related field (or foreign education equivalent) and six (6) years of experience as a Director, IT Audit Program Manager (or closely related occupation) performing IT audit, information security assessments, and critical technology risk management activities (evaluating risks, threats, and controls) for financial services applications and IT infrastructure for vendor, on premises and in Cloud.

Or, alternatively, Master’s degree in Computer Science, Engineering, Information Technology, Information Systems, Information Management, Technology Management, or a closely related field (or foreign education equivalent) and four (4) years of experience as a Director, IT Audit Program Manager (or closely related occupation) performing IT audit, information security assessments, and critical technology risk management activities (evaluating risks, threats, and controls) for financial services applications and IT infrastructure for vendor, on premises and in Cloud.

Skills and Knowledge:

Candidate must also possess:

• Demonstrated Expertise triaging and providing guidance on implementing controls for existing and emerging technology risks within complex financial management and operations systems, using Power BI, Tableau, and Microsoft Office Suite (PowerPoint, Word, and Copilot), to optimize audit planning, risk prioritization, and the design, implementation, and management of a technology risk program that enables the business to build control programs that mitigate risk and meet corporate standards.

• Demonstrated Expertise auditing internal controls and examining regulatory, financial, and technology risk, using Python scripts, Microsoft Excel functions and Macros, across enterprise technology, risk and compliance functions and finance, human resources, real estate, legal, diversified strategic investments, charitable, and emerging business incubator initiatives.

• Demonstrated Expertise performing IT risk analysis and security assessments of corporate-wide IT infrastructure; performing Cloud and system development using cybersecurity principles and techniques - NIST CSF; and identifying technical control weaknesses, system vulnerabilities, and insecure configurations, using Amazon Web Services (AWS), Docker, API, Oracle DB, and Microsoft SQL Server.

• Demonstrated Expertise verifying the security and efficiency of Secure Software Development Lifecycle (SSDLC) processes, using DevOps and vulnerability scanning platforms – Github, Jenkins, Artifactory, and Qualys; and identifying security gaps in privileged accounts administration, secrets management, and identifying services using AWS Secrets Manager, Hashicorp, CyberArk, Active Directory, SAML, and oAuth.

PE1M2

Please be advised that Fidelity’s business is governed by the provisions of the Securities Exchange Act of 1934, the Investment Advisers Act of 1940, the Investment Company Act of 1940, ERISA, numerous state laws governing securities, investment and retirement-related financial activities and the rules and regulations of numerous self-regulatory organizations, including FINRA, among others. Those laws and regulations may restrict Fidelity from hiring and/or associating with individuals with certain Criminal Histories.