About Your Role The Lead, Controls Assurance role is a senior individual contributor of the Security Governance, Risk, and Compliance (GRC) team at Bridgewater. The GRC team is responsible for Bridgewater's compliance with security regulations, client obligations, and the practical understanding, communicating, and building of programmatic readiness to respond to the security risks facing the company. You will be response for developing, evaluating, testing, and strengthening the design and operating effectiveness of internal security controls across the organization. This role partners closely with business units, technology partners, risk owners, and audit teams to ensure controls remain fit for purpose and regulatory and compliance obligations are met. You will maintain overall oversight and execution of how the Security department manages the firm's controls posture, including identification or mitigation of any control deficiencies. Additionally, this role will have a significant focus on controls automation and monitoring to further mature the program.
You Will Drive the Following Responsibilities - Develop and lead the Controls Assurance Program at Bridgewater.
- Plan and execute control testing plans across operational, security, and technology risk areas.
- Gather and review process documentation, evidence, control narratives, and risk-control matrices for accuracy and completeness.
- Identify control gaps, design weaknesses, and instances of non-compliance, and document findings clearly.
- Partner with process and control owners to remediate issues and track remediation to closure.
- Support audit requests, including evidence gathering and walkthroughs.
- Prepare assurance reports and dashboards summarizing testing results for senior stakeholders.
- Drive continuous improvement of testing methodologies, sampling approaches, control frameworks, and tooling and automation.
- Develop risk reporting, metrics, and summary reporting for executive leadership.
- Stay current on regulatory changes and industry standards that impact the control environment.
Key Responsibilities Further Detailed - The many facets (policy, standards, implementation, assurance) of a mature security governance, risk, and compliance (GRC) program. Bonus if your knowledge is derived from experience operating in a U.S. and/or global asset management regulatory context.
- SOC 1 / SOC 2 criteria, NIST, CIS, and applicable regulatory frameworks, internal control frameworks, and control self-assessment best practices.
- The design, implementation, and maintenance of a comprehensive IT and security controls program.
- Data analysis tools and techniques used to support control testing.
- Leveraging controls automation platforms to streamline evidence collection, monitoring, and reporting for compliance efforts.
- Audit methodologies, sampling techniques, evidence standards, remediation tracking.
- The evolution of regulatory and compliance requires in the investment management space. Bonus if you've had exposure to global regulatory regimes beyond U.S. regulators like the SEC and CFTC.
Key to Success in the Role - Quickly learn about business processes, how technology is used and controlled, and managing associated security controls and risks.
- Develop and execute strategic visions for a mature Controls program.
- Independently plan and execute testing procedures with minimal oversight.
- Navigate different levels of thinking; capture and incorporate feedback from different audiences.
- Summarize complex ideas and requirements into digestible syntheses that convey core ideas.
- Apply conceptual requirements to a programmatic implementation and a plan of action to get from the current state to the desired state.
- Interpret policies, procedures, and regulatory requirements and apply them practically to real processes.
- Exercise sound professional judgment when assessing control adequacy and risk significance
- Communicate difficult or sensitive findings constructively and diplomatically.
- Adapt quickly to new business areas or regulatory changes.
Minimum Qualifications - A Bachelor's or Master's Degree in an analytical, scientific, liberal arts, or related field.
- 7-10 years of experience in risk management, information security, and/or cybersecurity compliance.
- CISA, CISSP, or related certifications preferred.
- Proven track record in designing and building controls assurance programs.
- Experience in a highly regulated and fast-paced industry, especially financial services, is strongly preferred.
- Thrive in an environment focused on excellence
- Are passionate about the importance of security and prepared to think critically about practical security problems without defaulting to "check the box" thinking
- Have a strong ownership mentality and drive for results.
- Value truth, openness, and pursuing excellence.
Onsite Requirements The onsite requirement for this role is four days onsite flexing between our NYC and CT offices.
Compensation The wage range for this role is $225,000 to $375,000 inclusive of base salary and discretionary bonus. The expected base salary for this role is between 70-80% of this wage range.
