Role Overview

The Risk & Compliance Project Manager and Application Manager is a dual-mandate leadership role designed to oversee the end-to-end lifecycle, stability, and evolution of critical enterprise risk, regulatory, and compliance software applications, while concurrently driving large-scale regulatory and compliance technology initiatives. This hybrid position bridges business risk units, compliance officers, information security teams, internal/external auditors, and core IT engineering groups. The incumbent ensures that business-critical compliance applications operate reliably, securely, and in full alignment with evolving domestic and global regulatory standards (e.g., SOX, GDPR, GLBA, DORA, Basel/FRTB, AML/KYC), while managing multi-stream technical projects from inception through delivery.

Key Responsibilities

Part A: Application Management & Operational Governance

- Lifecycle & Operational Ownership: Own the operational health, support frameworks, SLA adherence, and ongoing lifecycle of GRC (Governance, Risk, and Compliance), RegTech, and audit platforms.
- Application Availability & Resiliency: Oversee system performance, disaster recovery planning, business continuity (BCP/DR), and observability for mission-critical risk data pipelines and reporting engines.
- Release & Change Management: Govern change control boards (CCB) and application release schedules, ensuring all configuration changes, patches, and version upgrades maintain strict auditability and minimal operational downtime.
- Incident & Problem Management: Act as technical escalation lead for high-severity incidents, orchestrating rapid resolution, root-cause analysis (RCA), and preventative control remediation.
- Access Governance & Data Protection:



Enforce least-privilege role-based access control (RBAC), segregation of duties (SoD), and sensitive data encryption across all managed compliance systems.

Part B: Risk, Compliance & Regulatory Assurance

- Regulatory Interpretation & Alignment: Translate new regulatory mandates, industry frameworks, and supervisory guidance into actionable application architecture requirements and project roadmaps.
- Audit & Exam Management: Serve as the primary technical interface for internal audit teams, external regulatory bodies, and third-party risk assessors; ensure timely delivery of evidentiary artifacts and control testing data.
- Issue Tracking & Remediation (CAPs/MRAs): Manage the identification, tracking, and technical remediation of audit findings, corrective action plans (CAPs), Matters Requiring Attention (MRAs), and vulnerability assessments.
- Continuous Control Monitoring: Design and maintain automated key risk indicators (KRIs) and key control indicators (KCIs) embedded within application workflows.

Part C: Project & Program Management

- End-to-End Project Delivery: Lead complex regulatory technology and compliance integration initiatives from scoping, business case formulation, and milestone tracking to deployment and operational handover.
- Methodology & Governance: Apply Agile, Waterfall,



or hybrid project management methodologies to coordinate cross-functional sprints, release gates, and steering committee cadences.
- Scope, Budget & Resource Management: Manage project schedules, resource allocations, dependency risks, and financial budgets (CapEx/OpEx).
- Executive Reporting & Stakeholder Alignment: Deliver comprehensive project scorecards, risk burndown charts, and executive status dashboards to Chief Risk Officers (CRO), Chief Compliance Officers (CCO), and IT leadership.

Part D: Vendor & Third-Party Risk Management

- Vendor Oversight: Oversee relationships with GRC/RegTech software vendors and implementation partners, monitoring performance against contractual SLAs and statements of work (SOWs).
- Third-Party Risk Assessment (TPRM): Conduct ongoing third-party technology risk assessments, SOC report reviews, and security posture evaluations for vendor-hosted applications.

Required Qualifications & Experience

Professional Experience

- 6-8+ years of progressive experience spanning IT application management, technology project management, and technology risk/compliance governance within regulated environments (e.g., Financial Services, Banking, Healthcare, or FinTech).
- Proven track record of managing enterprise GRC/RegTech platforms (e.g., ServiceNow IRM/GRC, Archer, MetricStream, OneTrust, Actimize, or proprietary risk calculation engines).
- Demonstrated experience delivering high-stakes regulatory technology projects, managing regulatory examinations, and resolving audit findings.

Technical & Domain Competencies

- Regulatory Frameworks: Robust working knowledge of major regulatory standards and control

📌 Risk & Compliance Project Manager and Application Manager (Mississauga)
🏢 Citi
📍 Mississauga