Associate Principal, Operational Risk Management, IT & Security

Duties: Provide critical support to the Director of Operational Risk to evaluate IT and Security risks by assisting with risk assessments and applying aspects of the risk management framework across the process, risk, and control universe. Collaborate with IT, Security, TPRM, Legal, Compliance, and Internal Audit to ensure that ORM contributes to strengthening the overall effective management of IT and Security risk across the organization.

Lead the OCC’s risk identification and assessment process (Risk Intake) for IT, Security and business risks, and verify the consistency and reliability of the associated frameworks and systems. Drive adherence to methodologies, guidance, and standards applicable to risk identification and assessment frameworks. Maintain risk inventories, taxonomies, and other elements supporting IT & Security risk management and compliance activities. Lead and execute the IT and Security risk assessment process, while aligning to the risk and control universe, and regulatory requirements and expectations.

Execute risk identification, analysis, and enterprise risk assessments to verify consistency and reliability with NIST and COBIT frameworks and align with regulatory requirements by leveraging RSA Archer, JIRA, and ServiceNow. Develop Artificial Intelligence governance assessment protocols encompassing onboarding risk analysis, control gap evaluations, and continuous monitoring, and create AI risk registers aligned to NIST AI Risk Management Framework using RSA Archer, JIRA, and ServiceNow.

Audit technology program utilizing Distributed Ledger Technology (DLT), assessing functional and non-functional requirements traceability, vendor entitlement configurations against contractual obligations, and architectural integration risks of DLT into existing clearing and settlement environments using SpiraTest, SailPoint, and RSA Archer.

Administer and review Identity and Access Management (IAM) controls and access governance processes, including Role-Based Access Control (RBAC), user access reviews, entitlement reviews, least-privilege controls, and group-based access policies, using IAM tools such as Microsoft Active Directory, ManageEngine ADManager Plus, and Microsoft 365 Admin Center. Communicate results of risk assessments to governance committees, business owners, and various levels of leadership.

Collaborate on the enhancement and maintenance of ORM program methodologies, policies, procedures, and job aides, including the development of new program activities. Track and update ORM team internal findings, external exam issues, and business area self-identified issues resulting from Enterprise Risk Assessment. Up to 40% telecommuting permitted.

OCC offers a standard benefits package._This position qualifies for The Options Clearing Corporation’s Employee Referral Program._ Education & Experience Required: Bachelor’s degree in computer science, information systems, business information technology, or related and three (3) years of experience as an operational risk management associate, security intern, project manager, or related Special Skills Required: Must have work experience with each of the following: 1) Execute risk identification, analysis, and enterprise risk assessments to verify consistency and reliability with NIST

and COBIT frameworks and align with regulatory requirements by leveraging RSA Archer, JIRA, and ServiceNow; 2) Develop Artificial Intelligence governance assessment protocols encompassing onboarding risk analysis, control gap evaluations, and continuous monitoring, and create AI risk registers aligned to NIST AI Risk Management Framework using RSA Archer, JIRA, and ServiceNow; 3) Audit technology program utilizing Distributed Ledger Technology (DLT), assessing functional and non-functional requirements traceability, vendor entitlement configurations against contractual obligations, and

architectural integration risks of DLT into existing clearing and settlement environments using SpiraTest, SailPoint, and RSA Archer; and 4) Administer and review Identity and Access Management (IAM) controls and access governance processes, including Role-Based Access Control (RBAC), user access reviews, entitlement reviews, least-privilege controls, and group-based access policies, using IAM tools such as Microsoft Active Directory, ManageEngine ADManager Plus, and Microsoft 365 Admin Center. Up to 40% telecommuting permitted.

Salary $106,808-$120,000 Apply: OCC offers a standard benefits package. See a full list of benefits here: https://www.theocc.com/careers/thriving-together. Apply online at www.theocc.com. No calls. EOE. About Us The Options Clearing Corporation (OCC) is the world's largest equity derivatives clearing organization. Founded in 1973, OCC is dedicated to promoting stability and market integrity by delivering clearing and settlement services for options, futures and securities lending transactions.

As a Systemically Important Financial Market Utility (SIFMU), OCC operates under the jurisdiction of the U.S. Securities and Exchange Commission (SEC), the U.S. Commodity Futures Trading Commission (CFTC), and the Board of Governors of the Federal Reserve System. OCC has more than 100 clearing members and provides central counterparty (CCP) clearing and settlement services to 19 exchanges and trading platforms. More information about OCC is available at www.theocc.com. Benefits A highly collaborative and supportive environment developed to encourage work-life balance and employee wellness.

Some of these components include: A hybrid work environment, up to 2 days per week of remote work Tuition Reimbursement to support your continued education Student Loan Repayment Assistance Technology Stipend allowing you to use the device of your choice to connect to our network while working remotely Generous PTO and Parental leave 401k Employer Match Competitive health benefits including medical, dental and vision Visit https://www.theocc.com/careers/thriving-together for more information.

Compensation The salary range listed for any given position is exclusive of fringe benefits and potential bonuses. If hired at OCC, your final base salary compensation will be determined by factors such as skills, experience and/or education. In addition, we believe in the importance of pay equity and consider internal equity of our current team members as part of any final offer. We typically do not hire at the maximum of the range in order to allow for future and continued salary growth.

We also offer a substantial benefits package as noted on www.theocc.com/careers All employees may be eligible for a discretionary bonus. Discretionary bonuses are based on various factors, including, but not limited to, company and individual performance and are not guaranteed. Step 1 When you find a position you're interested in, click the 'Apply' button. Please complete the application and attach your resume. Step 2 You will receive an email notification to confirm that we've received your application.

Step 3 If you are called in for an interview, a representative from OCC will contact you to set up a date, time, and location. For more information about OCC, please click here. OCC is an Equal Opportunity Employer Protect yourself from recruitment scams Employers are seeing an increase in activity involving individuals falsely claiming to represent our company. These scams often include fake job offers, interviews or requests for financial and personal information. We take these matters seriously and want to ensure you stay informed and protected throughout your job search.

Please keep the following in mind: OCC will never ask for payment or request personal banking information at any stage of the recruitment or career process. All official recruitment communications will come from a verified OCC email address ending in @theocc.com or the specific e-mail address of theocc@myworkday.com. Be cautious of messages from personal or non-company email addresses. Do not engage with or respond to suspicious emails or messages. If you are unsure about the legitimacy of a communication, verify the sender's email address and contact us directly.

Hover over the sender's email address and confirm it ends with @theocc.com or myworkday.com and be alert for misspellings or added words. If you receive a suspicious email, text or phone call using OCC's name, please forward it to talentacquisition@theocc.com. Interviews OCC does not utilize video chat rooms (that is, Google Hangouts) to conduct interviews. OCC will only use our approved Zoom video interview platform. Your vigilance helps protect you and supports the integrity of our hiring process. Recognizing fraudulent communications Phishing emails often: Do not address you by name.

Create a sense of urgency to prompt quick action. Contain links that lead to suspicious websites or malicious attachments. Include grammatical or spelling errors. A highly collaborative and supportive environment developed to encourage work-life balance and employee wellness.

Some of these components include: A hybrid work environment, up to 2 days per week of remote work Tuition Reimbursement to support your continued education Student Loan Repayment Assistance Technology Stipend allowing you to use the device of your choice to connect to our network while working remotely Generous PTO and Parental leave Competitive health benefits including medical, dental and vision OCC is an Equal Opportunity Employer OCC is an equal opportunity employer that is committed to diversity, equity, and inclusion.

OCC provides equal employment opportunities to all employees and applicants for employment without regard to race, color, national origin, citizenship status, sex, sexual orientation, gender identity or expression, disability, age, marital status, religion, veteran status, or any other characteristics protected by applicable federal, state, or local laws. Numerous studies have shown that people from certain groups are less likely than others to apply to jobs if they believe they do not meet 100% of the requirements.

We encourage everyone to review our open positions and apply if you think your experience may be a match, even if you do not meet all of the qualifications. Your perspective may be an element we need to continue building innovative solutions to support the markets and market participants we serve. If you need a disability related accommodation for any part of the application process, please email talentacquisition@theocc.com. The Options Clearing Corporation (OCC) is the world's largest equity derivatives clearing organization.

Founded in 1973, OCC is dedicated to promoting stability and market integrity by delivering clearing and settlement services for options, futures and securities lending transactions. As a Systemically Important Financial Market Utility (SIFMU), OCC operates under the jurisdiction of the U.S. Securities and Exchange Commission (SEC), the U.S. Commodity Futures Trading Commission (CFTC), and the Board of Governors of the Federal Reserve System. OCC has more than 100 clearing members and provides central counterparty (CCP) clearing and settlement services to 19 exchanges and trading platforms.

More information about OCC is available at www.theocc.com. A highly collaborative and supportive environment developed to encourage work-life balance and employee wellness.

Some of these components include: A hybrid work environment, up to 2 days per week of remote work Tuition Reimbursement to support your continued education Student Loan Repayment Assistance Technology Stipend allowing you to use the device of your choice to connect to our network while working remotely Generous PTO and Parental leave 401k Employer Match Competitive health benefits including medical, dental and vision Visit https://www.theocc.com/careers/thriving-together for more information. The salary range listed for any given position is exclusive of fringe benefits and potential bonuses.

If hired at OCC, your final base salary compensation will be determined by factors such as skills, experience and/or education. In addition, we believe in the importance of pay equity and consider internal equity of our current team members as part of any final offer. We typically do not hire at the maximum of the range in order to allow for future and continued salary growth. We also offer a substantial benefits package as noted on www.theocc.com/careers All employees may be eligible for a discretionary bonus.

Discretionary bonuses are based on various factors, including, but not limited to, company and individual performance and are not guaranteed.

• Bachelor’s degree in computer science, information systems, business IT, or related field with 3 years operational risk or related experience
• Experience executing risk assessments using NIST, COBIT, RSA Archer, JIRA, and ServiceNow
• Proficiency in AI governance, DLT auditing, and IAM controls with tools like SpiraTest, SailPoint, Microsoft Active Directory, and ManageEngine