Program Manager – Level III

About the role

The Program Manager‑Level III will join the Digital Technology team to strengthen the design, implementation, and operation of technology controls across the enterprise. You will plan and execute control testing, evaluate evidence against audit standards, drive remediation, and assess risk for AI systems as the organization expands its AI usage.

Key responsibilities

• Design, document, and recommend technology controls aligned with NIST AI Risk Management Framework, NIST SP 800‑53, ISO 27001, and SOX IT General Controls.
• Perform design and operating effectiveness testing for AI RMF controls, IT General Controls (Logical Access, Change Management, IT Operations) and IT Application Controls.
• Develop repeatable, auditor‑defensible test plans and document procedures, sampling rationale, results, and conclusions.
• Collect, organize, and critically evaluate control evidence for completeness, accuracy, and relevance.
• Support AI risk assessments for internal and third‑party AI tools, evaluating risk across multiple domains.
• Analyze emerging regulatory and internal policy requirements, identify control gaps, and propose remediation.
• Manage identified issues: determine root causes, recommend solutions, track commitments, and escalate as needed.

Required profile

• Undergraduate degree in Information Technology, Management Information Systems, or a related field.
• 5+ years of experience in IT risk management, information security compliance, or internal IT audit within large enterprises.
• Proven ability to communicate complex control findings to technical and non‑technical stakeholders, including senior leadership.
• Strong analytical, technical, and problem‑solving skills with meticulous attention to detail.
• Experience with IT General Controls (Logical Access, Change Management, IT Operations) and familiarity with Big 4 audit environments is preferred.

Required skills

• NIST AI Risk Management Framework
• NIST SP 800‑53
• ISO 27001
• SOX IT General Controls
• IT General Controls (Logical Access, Change Management, IT Operations)
• IT Application Controls
• Control testing and audit methodology
• AI risk assessment