Tech Risk & Controls Lead - Application Risk Classification (ARC) & Model Development

Job Description
Tech Risk & Controls Lead - Application Risk Classification (ARC) & Model Development
Job Summary
Join our team to play a pivotal role in advancing JPMC's technology risk management capabilities. As the Tech Risk & Controls Lead, you will own and continuously enhance the Application Risk Classification (ARC) model, while supporting the development and integration of other risk models and performing thematic analysis. You will drive innovation in risk modelling, ensure operational excellence, and provide actionable insights to senior leadership, helping the firm proactively manage technology and cyber risks in a dynamic environment.
Key Responsibilities

• Own and Enhance ARC Model: Lead the ownership, maintenance, and continuous improvement of JPMC's Application Risk Classification (ARC) model, ensuring it adapts to evolving threats, technology changes, and regulatory requirements.
• Support Broader Model Development: Collaborate on the development, integration, and prioritization of additional risk models including de-duplication and reconciliation of risk findings from multiple sources.
• Thematic Analysis & Insights: Conduct thematic analysis of risk data to identify trends, vulnerabilities, and areas for improvement. Provide actionable recommendations to inform risk-based decision making.
• Stakeholder Engagement: Partner with engineering, security, business, and data teams to embed risk models into operational and strategic processes. Build trusted relationships to facilitate cross-functional collaboration.
• Reporting & Communication: Communicate risk priorities, model outcomes, and business implications to both technical and non-technical audiences. Translate complex technical risk data into clear, actionable recommendations for senior leadership.

Required Qualifications, Capabilities, and Skills

• Proven experience in technology risk management, cyber risk modelling, or information security, with a focus on risk identification, assessment, and mitigation.
• Strong understanding of application risk classification, risk scoring methodologies and prioritization frameworks.
• Advanced data analysis skills; proficiency in SQL, Python, R, or equivalent tools.
• Experience with techniques for de-duplicating and reconciling risk findings from multiple sources (e.g., vulnerability scanners, code reviews, threat intelligence).
• Ability to synthesize complex technical information and present it in a clear, concise manner to senior executives.
• Familiarity with regulatory frameworks (e.g., NIST, ISO 27001, CIS Controls) and financial industry requirements.
• Demonstrated ability to influence strategic decision-making and translate technology insights into business strategies.
• Excellent written and verbal communication skills.
• Proactive in staying updated on cyber threat trends, regulatory changes, and emerging technologies.

Preferred Qualifications

• Industry-recognized certifications such as CISM, CRISC, CISSP, or similar.
• Experience leading risk model development, application risk classification, or data de-duplication initiatives.

About Us
J.P. Morgan is a global leader in financial services, providing strategic advice and products to the world's most prominent corporations, governments, wealthy individuals and institutional investors. Our first-class business in a first-class way approach to serving clients drives everything we do. We strive to build trusted, long-term partnerships to help our clients achieve their business objectives.
We recognize that our people are our strength and the diverse talents they bring to our global workforce are directly linked to our success. We are an equal opportunity employer and place a high value on diversity and inclusion at our company. We do not discriminate on the basis of any protected attribute, including race, religion, color, national origin, gender, sexual orientation, gender identity, gender expression, age, marital or veteran status, pregnancy or disability, or any other basis protected under applicable law. We also make reasonable accommodations for applicants' and employees' religious practices and beliefs, as well as mental health or physical disability needs. Visit our FAQs for more information about requesting an accommodation.
About the Team
Our professionals in our Corporate Functions cover a diverse range of areas from finance and risk to human resources and marketing. Our corporate teams are an essential part of our company, ensuring that we're setting our businesses, clients, customers and employees up for success.