Enterprise Incident Management – Scenario Library Lead

The position is described below. If you want to apply, click the Apply Now button at the top or bottom of this page. After you click Apply Now and complete your application, you'll be invited to create a profile, which will let you see your application status and any communications. If you already have a profile with us, you can log in to check status.

Need Help?

If you have a disability and need assistance with the application, you can request a reasonable accommodation. Send an email to Accessibility (accommodation requests only; other inquiries won't receive a response).

Regular or Temporary:

Regular

Language Fluency:  English (Required)

Work Shift:

1st shift (United States of America)

Please review the following job description:

The Scenario Library Lead owns Truist's all-hazards library of severe but plausible scenarios, the basis on which the bank determines whether each important business service can remain within its impact tolerance under severe disruption. Each scenario must be severe enough to identify the point of failure and credible enough for service owners, executives and examiners to accept.

Frontier AI is the role's primary focus. The same models that speed up legitimate work are available to adversaries, run inside the bank's own processes and sit inside the services its third and fourth parties deliver, and the role writes the scenarios in which they cause or amplify a disruption.

The role requires a working understanding of how these systems are built, how they fail and how adversaries use them, applied to scenarios the bank can test against. It is an operational resilience position within Enterprise Incident Management.

Scenario library ownership
• Build and maintain the enterprise library of severe but plausible scenarios, including its taxonomy, a coverage map against important business services and their impact tolerances, version control and an annual refresh cycle.
• Write every scenario to a single standard: trigger, cascade, timeline, affected services and dependencies, assumptions, severity rated against the Board-approved Enterprise Incident Severity Matrix, and the questions the test must answer.
• Establish and defend the plausibility threshold with evidence drawn from threat intelligence, Truist incident history and after-action reviews, industry events and supervisory expectations.
• Maintain all-hazards coverage across the library's six categories (cyber; third party and concentration; infrastructure and facility; natural and climate; people and insider; liquidity and confidence), including compound scenarios in which two events strike together, with frontier AI-enabled scenarios as the primary area of new development.
• Retire scenarios that no longer meet the threshold and document the rationale.

Frontier AI-enabled scenarios
• Develop the scenarios in which an adversary applies frontier models against the bank, including AI-generated exploits against Truist's technology estate, autonomous intrusion agents, voice and video cloning directed at Truist and its clients, synthetic identity fraud at scale, and AI-driven disinformation that produces deposit outflows.
• Develop the scenarios in which the bank's own AI systems fail, including agents acting beyond their mandate, poisoned training or retrieval data, prompt injection against teammate- and client-facing assistants, undetected drift in models used for decisions, and loss of a model provider or hosted API on which the bank depends.
• Develop the scenarios in which a 3rd, 4th, or nth party's AI fails or is compromised, including a core processor's or payments vendor's model that blocks or misroutes legitimate transactions at scale, a vendor's AI-driven operations tooling that pushes a defective change to every client at once, a poisoned or drifting model at a fraud, KYC or credit-decisioning vendor, and a service provider's AI assistant that exposes client data.
• Map the bank's 3rd, 4th, and nth party exposure to foundation-model providers, and write the concentration scenarios in which a single model outage or defective update reaches the bank through several suppliers at once.
• Monitor frontier model capability through model developer system cards, red-team findings, government evaluations and threat intelligence from Truist Protection Services (TPS) and FS-ISAC, and reflect any material change in the library within the quarter.
• Coordinate with TPS, Truist's AI teams, Model Risk Management, and Third Party Risk Management so that each scenario reflects the controls, models and vendor dependencies in place.
• Advise senior executive leadership at the bank on the implications of expected model capability over the next 12 to 24 months for the bank's exposure.

Impact tolerance testing of important business services
• Establish the method that maps each scenario onto a service's dependency chain across people, technology, data, facilities and third parties.
• Design and conduct the tests, including tabletop exercises with service owners, technical walkthroughs and simulations where a desk-based exercise cannot settle the question.
• Record a single finding for each test (within tolerance, breached or undetermined) together with the point of failure and its cause.
• Convert findings into remediation proposals with owners and target dates, and track them to closure in EIM's action register.
• Provide results for ERO's resilience reporting to executive and Board committees.

Exercise program and industry representation
• Provide the scenarios for EIM's exercise calendar, including the annual executive crisis leadership team exercises, and lead scenario design for enterprise-level exercises.
• Represent EIM in industry exercises and forums and incorporate their findings into the library.
• Document the findings of each exercise and the changes made as a result.
Examination readiness and documentation
• Document the library, the method and the findings to the standard Truist's prudential regulators expect of a large financial institution.
• Align the library with the interagency Sound Practices to Strengthen Operational Resilience (2020) and the Basel Committee Principles for Operational Resilience (2021).
• Support independent challenge by Enterprise Resilience Risk Management (second line) and review by Internal Audit and provide examiners with evidence that each important business service has been tested.

For this opportunity, Truist will not sponsor an applicant for work visa status or employment authorization, nor will we offer any immigration-related support for this position (including, but not limited to H-1B, F-1 OPT, F-1 STEM OPT, F-1 CPT, J-1, TN-1 or TN-2, E-3, O-1, or future sponsorship for U.S. lawful permanent residence status.)

ESSENTIAL DUTIES AND RESPONSIBILITIES
Following is a summary of the essential functions for this job. Other duties may be performed, both major and minor, which are not mentioned below. Specific activities may change from time to time.
1. Manages a small to mid-sized technology operations team within the job area, which may often include leading lower level managers and experienced individual contributors to deliver secure, reliable services against defined objectives.
2. Implements short to midterm operational plans and priorities for the job area that are set by executives and senior management, helping to shape key elements and being accountable for timely, high-quality execution.
3. Translates technology strategies and roadmaps into detailed team goals, schedules, and work assignments, making informed day-to-day decisions and tradeoffs within established parameters to keep delivery on track.
4. Applies and enforces governance, risk management, and compliance practices in the team’s work, ensuring adherence to enterprise frameworks and escalating issues or exceptions to more senior leaders.
5. Leads the execution of technology initiatives and operational improvement efforts for the team, delivering measurable improvements in stability, efficiency, and service quality.
6. Provides operational insight, performance data, and risk signals from the team to senior leaders and stakeholders, contributing to adjustments in tactical and operational plans.
7. Drives innovation at the team level by implementing improved standards, processes, and operating methods, and by advancing practical use of automation and relevant technologies to enhance outcomes.
8. Manages day-to-day interactions with key vendors, partners, and stakeholders for the team’s scope, making timely decisions on service performance and operational issues within approved contracts and guidelines.
9. Monitors operational performance for the team against defined targets, leading continuous improvement to optimize cost awareness, quality, resilience, and colleague experience.
10. Provides hands-on leadership, coaching, and development for lower level managers and senior individual contributors, building team capability, engagement, and accountability for delivering agreed plans.

Required Qualifications:
The requirements listed below are representative of the knowledge, skill and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.
1. Bachelor’s degree or higher in Information Technology, Computer Science, Business Administration, or related field.
2. Minimum of 7 years of progressive experience in technology operations.
3. Advanced leadership and management experience leading technology operations teams.
4. Proficiency in IT infrastructure, cloud technologies, cybersecurity, compliance, and enterprise risk management.
5. Proven track record in strategic planning, technology governance, and leading large, complex operations.

Preferred Skills:

• Ten or more years in operational resilience, incident or crisis management, cybersecurity, cyber threat intelligence or security research, primarily within financial services or other critical infrastructure.
• Experience building and operating an all-hazards scenario library used to test services against impact tolerance, covering cyber, third-party, infrastructure, natural hazard, people and liquidity events, with the ability to present the scenarios, the method and the test results.
• Working knowledge of how frontier AI systems are built and deployed, including large language models, agents and tool use, training and retrieval data, and hosted model APIs, sufficient to assess failure and misuse independently.
• Cybersecurity fluency, including MITRE ATT&CK and ATLAS, the OWASP Top 10 for LLM applications, threat intelligence practice, and adversary and red-team tradecraft.
• Infrastructure fluency, including the operation of a large bank's technology estate from mainframe and core banking through payment rails, networks, data centers and cloud to the third parties, their subcontractors and the financial market utilities that support them.
• Strong written communication. Scenarios, findings and briefs must be concise, concrete and readable by an executive in a single sitting.
• Ability to lead senior leaders to a decision and to sustain the plausibility threshold under challenge.
• Knowledge of US supervisory expectations for operational resilience at a large bank, including the interagency Sound Practices (2020) and the Basel Principles (2021), and of how examiners assess scenario testing.
• Experience in a first-line resilience or incident management function at a Category III or larger US bank.
• Experience red-teaming AI systems, evaluating model capability, or working in model risk management under SR 11-7.
• Experience designing or conducting industry exercises such as Quantum Dawn or the Hamilton Series.
• MBCP or CBCP, CISSP, GIAC Cyber Threat Intelligence (GCTI), or an equivalent certification.
• Graduate degree in computer science, security, risk management or a related field.
• Direct experience on a crisis management team during a severe live incident.

General Description of Available Benefits for Eligible Employees of Truist Financial Corporation: All regular teammates (not temporary or contingent workers) working 20 hours or more per week are eligible for benefits, though eligibility for specific benefits may be determined by the division of Truist offering the position. Truist offers medical, dental, vision, life insurance, disability, accidental death and dismemberment, tax-preferred savings accounts, and a 401k plan to teammates. Teammates also receive no less than 10 days of vacation (prorated based on date of hire and by full-time or part-time status) during their first year of employment, along with 10 sick days (also prorated), and paid holidays. For more details on Truist’s generous benefit plans, please visit our Benefits site. Depending on the position and division, this job may also be eligible for Truist’s defined benefit pension plan, restricted stock units, and/or a deferred compensation plan. As you advance through the hiring process, you will also learn more about the specific benefits available for any non-temporary position for which you apply, based on full-time or part-time status, position, and division of work.

Truist is an Equal Opportunity Employer that does not discriminate on the basis of race, gender, color, religion, citizenship or national origin, age, sexual orientation, gender identity, disability, veteran status, or other classification protected by law. Truist is a Drug Free Workplace.

EEO is the Law    E-Verify IER Right to Work