The Enterprise Data and Tool Risk Analyst supports the Data Risk Oversight and Tools Risk Management Director in fulfilling the Director’s dual mandate within Enterprise Risk Management (ERM). First, the role supports the day-to-day administration of City National Bank’s Tool Risk Management (TRM) Program, including maintenance of the enterprise tool inventory, attestations, classification, validation coordination, change management monitoring, and reporting on the Bank’s Critical and Material tools. Second, the role supports the Director’s independent second line of defense (2LOD) oversight, review, and challenge of the Bank’s Data Management Program, including governance, classification, quality, certification, usage/privacy/sharing, and retention/disposal standards.
Working under the direction of the Director, the incumbent performs analysis, testing, and documentation; prepares evidence, metrics, and reporting packages; and coordinates with first-line tool owners, Data Domain Owners, and Data Stewards. The ideal candidate should have a data analytics or data engineering background, hands-on experience with data tools and End User Computing / User-Developed Applications (EUC/UDA), and an interest in data governance and regulatory expectations for risk data aggregation and reporting.
What You'll Do:
Support of the CNB Tool Risk Management Program
Tool Inventory, Classification and Attestation
- Supports the Director in maintaining the Tool Risk Management Program governing documents, procedures, and templates, drafting updates for the Director’s review.
- Maintains the enterprise tool inventory, ensuring the use, ownership, location, risk classification, and validation status of tools are complete and accurate; tracks tools through development, use, and retirement stages.
- Executes the annual tool ownership attestation process, including distributing requests, tracking responses, following up with tool owners, and identifying new, changed, or retired tools.
- Performs initial model-versus-tool identification and preliminary tool classification based on documented materiality and complexity criteria, for review and approval by the Director in coordination with the Model Risk Management Manager.
- Analyzes tool owners’ proposed risk classifications and suggested validation timing, documenting observations to support the Director’s review and challenge.
Tool Risk Assessment and Validation Support
- Supports interdisciplinary risk assessments for tools such as RPAs (bots) and AI Agents prior to implementation, gathering information from 1LOD and 2LOD teams and preparing materials for the technology change management committee and the AI Working Group.
- Maintains the Tool Validation Schedule, tracking that Critical and Material tools are validated as required and flagging significant changes or increases in risk that may trigger additional validations.
- Performs or supports tool validation activities as assigned, including review of tool design, input data, control effectiveness, benchmarking and independent recalculations, and tool use and reporting.
- Tests access governance over tool data, including role-based access control, least privilege, and completion of periodic User Access Reviews.
- Prepares and organizes validation workpapers and evidence for each Critical and Material tool for the Director’s review.
Tool Documentation and Change Management Support
- Reviews Critical and Material tool documentation for completeness against Tool Risk Program requirements and follows up with tool owners on gaps.
- Maintains the Master Tool Change Log and supports coordination with the Enterprise Technology change committee on tool change risk assessments and approvals.
- Tests tool owners’ change logs for compliance, including department approvals and final production verification.
- Performs testing of EUC/UDA controls applied to tools, including inventory completeness, documentation, version control, access restrictions, and periodic revalidation.
- Supports the director in the creation and reporting of KRIs, KPIs, and program metrics for the tool risk program
Support of 2LOD Oversight of the CNB Data Management Program
Review and Challenge Support
- Supports the Director’s independent 2LOD oversight of the Data Management Program by performing analysis and testing of governance structures, standards, and controls.
- Assists in the 2LOD review of data management policies and standards — including Data Governance, Change Management and Quality Control; Data Classification; Data Usage, Privacy and Sharing; and Data Retention and Disposal — by preparing comparisons, gap analyses, and draft comments.
- Reviews first-line self-assessments, control evidence, and remediation plans, documenting observations and potential issues for the Director’s challenge.
- During tool validations, performs data lineage and traceability testing to confirm that critical report figures can be traced to an authoritative source of record.
Reporting, Issues, and Regulatory Support
- Tracks tool and data findings, action plans, reschedules, and delayed items in accordance with the Enterprise Issues Management Policy, and prepares supporting documentation for risk acceptances.
- Collects data for and produces KRIs, KPIs, and program metrics for the tool risk and data management programs, including dashboards (e.g., Power BI) and reporting packages for the Operational Risk Committee, MERC, and BERC.
- Records and maintains tool and data risks, issues, and related evidence on the Bank’s enterprise risk / GRC platform (e.g., ServiceNow IRM).
- Supports internal and external audits and regulatory examinations by compiling inventories, evidence, and documentation, and assists in monitoring regulatory developments (FFIEC, GLBA, SOX/FDICIA, and BCBS 239).