Enterprise Data and Tool Risk Analyst

Overview

The Enterprise Data and Tool Risk Analyst supports the Data Risk Oversight and Tools Risk Management Director in fulfilling the Director’s dual mandate within Enterprise Risk Management (ERM). First, the role supports the day-to-day administration of City National Bank’s Tool Risk Management (TRM) Program, including maintenance of the enterprise tool inventory, attestations, classification, validation coordination, change management monitoring, and reporting on the Bank’s Critical and Material tools. Second, the role supports the Director’s independent second line of defense (2LOD) oversight, review, and challenge of the Bank’s Data Management Program, including governance, classification, quality, certification, usage/privacy/sharing, and retention/disposal standards.

Working under the direction of the Director, the incumbent performs analysis, testing, and documentation; prepares evidence, metrics, and reporting packages; and coordinates with first-line tool owners, Data Domain Owners, and Data Stewards. The ideal candidate should have a data analytics or data engineering background, hands-on experience with data tools and End User Computing / User-Developed Applications (EUC/UDA), and an interest in data governance and regulatory expectations for risk data aggregation and reporting.

What You'll Do:

Support of the CNB Tool Risk Management ProgramTool Inventory, Classification and Attestation

• Supports the Director in maintaining the Tool Risk Management Program governing documents, procedures, and templates, drafting updates for the Director’s review.
• Maintains the enterprise tool inventory, ensuring the use, ownership, location, risk classification, and validation status of tools are complete and accurate; tracks tools through development, use, and retirement stages.
• Executes the annual tool ownership attestation process, including distributing requests, tracking responses, following up with tool owners, and identifying new, changed, or retired tools.
• Performs initial model-versus-tool identification and preliminary tool classification based on documented materiality and complexity criteria, for review and approval by the Director in coordination with the Model Risk Management Manager.
• Analyzes tool owners’ proposed risk classifications and suggested validation timing, documenting observations to support the Director’s review and challenge.

Tool Risk Assessment and Validation Support

• Supports interdisciplinary risk assessments for tools such as RPAs (bots) and AI Agents prior to implementation, gathering information from 1LOD and 2LOD teams and preparing materials for the technology change management committee and the AI Working Group.
• Maintains the Tool Validation Schedule, tracking that Critical and Material tools are validated as required and flagging significant changes or increases in risk that may trigger additional validations.
• Performs or supports tool validation activities as assigned, including review of tool design, input data, control effectiveness, benchmarking and independent recalculations, and tool use and reporting.
• Tests access governance over tool data, including role-based access control, least privilege, and completion of periodic User Access Reviews.
• Prepares and organizes validation workpapers and evidence for each Critical and Material tool for the Director’s review.

Tool Documentation and Change Management Support

• Reviews Critical and Material tool documentation for completeness against Tool Risk Program requirements and follows up with tool owners on gaps.
• Maintains the Master Tool Change Log and supports coordination with the Enterprise Technology change committee on tool change risk assessments and approvals.
• Tests tool owners’ change logs for compliance, including department approvals and final production verification.
• Performs testing of EUC/UDA controls applied to tools, including inventory completeness, documentation, version control, access restrictions, and periodic revalidation.
• Supports the director in the creation and reporting of KRIs, KPIs, and program metrics for the tool risk program

Support of 2LOD Oversight of the CNB Data Management Program

Review and Challenge Support

• Supports the Director’s independent 2LOD oversight of the Data Management Program by performing analysis and testing of governance structures, standards, and controls.
• Assists in the 2LOD review of data management policies and standards — including Data Governance, Change Management and Quality Control; Data Classification; Data Usage, Privacy and Sharing; and Data Retention and Disposal — by preparing comparisons, gap analyses, and draft comments.
• Reviews first-line self-assessments, control evidence, and remediation plans, documenting observations and potential issues for the Director’s challenge.
• During tool validations, performs data lineage and traceability testing to confirm that critical report figures can be traced to an authoritative source of record.

Reporting, Issues, and Regulatory Support

• Tracks tool and data findings, action plans, reschedules, and delayed items in accordance with the Enterprise Issues Management Policy, and prepares supporting documentation for risk acceptances.
• Collects data for and produces KRIs, KPIs, and program metrics for the tool risk and data management programs, including dashboards (e.g., Power BI) and reporting packages for the Operational Risk Committee, MERC, and BERC.
• Records and maintains tool and data risks, issues, and related evidence on the Bank’s enterprise risk / GRC platform (e.g., ServiceNow IRM).
• Supports internal and external audits and regulatory examinations by compiling inventories, evidence, and documentation, and assists in monitoring regulatory developments (FFIEC, GLBA, SOX/FDICIA, and BCBS 239).

Qualifications

• 2-4 years of work experience in data analytics, data engineering, data management/governance, model/tool risk management, operational risk, or internal audit, preferably within financial services.
• 1-2 years of experience testing or reviewing tools/spreadsheets, performing control testing, or supporting a data management, data quality, or EUC/UDA program.
• Hands-on experience in data analytics, including sourcing, transforming, analyzing, and interpreting data to support risk and business decisions.
• Experience reviewing or building analytical tools, reports, and dashboards, with the ability to assess their design, logic, and control effectiveness.
• Languages: Python, SQL, and R.
• Platforms: Microsoft Fabric, Azure, and Snowflake.
• Data Engineering: ETL/ELT pipelines and pipeline orchestration, data modeling & warehouse architecture, and data quality & validation.
• Analytics and Business Intelligence: Power BI, Tableau, and SAS.
• Knowledge of tool/model risk management concepts: tool identification, classification (materiality and complexity), validation, and conclusion/grading systems
•  Familiarity with EUC/UDA controls, including inventory, risk tiering, documentation, access, version control, change management, and periodic revalidation.
• Ability to assess tool design, input data quality and integrity (ETL), syntax/code correctness, control environment, and tool use and reporting.
• Understanding of the Data Management Core Requirements — classification, data quality dimensions, metadata/lineage, access controls, and retention (GLBA/SOX) — and BCBS 239 principles for verifying data used by tools.
• Exposure to metadata management, business glossaries, data lineage and traceability, and data catalog tooling (e.g., Collibra).
• Familiarity with data classification and handling, data privacy and sharing controls, retention schedules, legal holds, and secure disposal requirements.
• Understanding of data certification, User Acceptance Testing, and preventive controls within data pipelines.
• Understanding of data governance roles, including Data Governance Councils, Data Management Offices, Data Domain Owners, and Data Stewards.
• Ability to test data quality dimensions (accuracy, completeness, timeliness, consistency, validity, uniqueness) and analyze data quality scorecards and exception reporting.
• Working knowledge of change management, access control (RBAC, UARs), and vendor risk management controls for internal and third-party tools.
• Strong analytical, documentation, and communication skills; able to challenge first-line owners respectfully and articulate findings to management.
• Detail-oriented, execution-oriented, and able to manage multiple validations and program activities to deadlines.

Education

• Bachelor's Degree in Finance, Data Analytics, Information Systems, Computer Science, Mathematics/Statistics, Risk Management, or a related field.

Certifications & Licenses:

• Professional risk, data, or analytics certifications (e.g., Certified Data Management Professional (CDMP), Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Auditor (CISA), or Microsoft Power BI Data Analyst (PL-300), or progress toward them, are a plus.

Special Instructions to Candidates

Equal Opportunity

City National Bank of Florida is an Equal Opportunity Employer. We do not discriminate based on race, color, religion, sex, national origin, age, disability, genetic information, protected veteran status, or any status protected by federal, state, or Florida law. We comply with the ADA and applicable Florida laws.

Interview Guidelines

To ensure a fair and consistent interview process, applicants are not permitted to use AI-enabled devices during interviews, including AI glasses or similar wearable technology that can record, transmit, or generate real-time information. 

Applicants who require a reasonable accommodation to participate in the interview process should contact [email protected] in advance of the interview to submit an accommodation request. City National Bank of Florida will engage in the interactive process and provide reasonable accommodations in accordance with applicable law.