Tech Risk and Controls

Your expertise in cybersecurity compliance can make a real impact — not just for a team, but for one of the world's most complex and consequential financial institutions. At JPMorganChase, we invest in our people, our technology, and our controls to stay ahead of an ever-evolving threat landscape. This is your opportunity to grow your career at the intersection of regulatory compliance, emerging technology, and enterprise-scale risk management.

As an Assessments & Exercises Senior Associate at JPMorganChase within the Cybersecurity Technology Controls Global Regulatory Assessments team, you will play a hands-on role in supporting end-to-end Payment Card Industry (PCI) compliance assessments that directly support the firm's multi-level PCI compliance validation efforts. You will collaborate with external assessor partners and internal control and application owners to ensure adherence to PCI Data Security Standard (PCI DSS) frameworks, while developing your technical depth and professional judgment in a high-impact, fast-paced environment. This role offers meaningful exposure to senior assessors, cross-functional stakeholders, and emerging automation tools — positioning you for continued growth within the firm's cybersecurity organization.

Job responsibilities

• Support and collaborate on multiple concurrent PCI assessments, adhering to established methodology, firm standards, and time-sensitive milestones through effective project management and stakeholder coordination
• Capture, review, and analyze PCI-required documentation, ensuring quality and suitability that meets PCI Security Standards Council (SSC) requirements while exercising professional judgment on complex technical and compliance matters
• Prepare for assessment walkthroughs, organize evidence, document discussions, and track follow-up actions in support of Vice Presidents and senior assessors throughout the assessment lifecycle; monitor key risk parameters to proactively identify non-compliance and assist in remediation efforts, including the evaluation of potential compensating controls to address security, risk, and control gaps
• Provide guidance on remediation activities for assigned business areas, supporting appropriate resolution of issues, action plans, and closure verification processes
• Research PCI requirements, emerging guidance, and industry developments; synthesize findings and share informed perspectives with the broader assessment team
• Maintain remediation tracking by managing action items, following up with stakeholders, validating submitted documentation, and escalating delays or concerns to the assessment lead; participate in team quality reviews, incorporate feedback, and progressively take ownership of defined assessment activities as knowledge and experience develop
• Leverage approved automation and large language model (LLM) tools to assist with evidence organization, requirement mapping, workpaper drafting, quality checks, and reporting — while validating outputs and safeguarding sensitive information
• Support the testing of controlled agentic workflows for repetitive administrative and assessment-support tasks, contributing feedback on accuracy, usability, risks, and improvement opportunities

Required qualifications, capabilities, and skills

• Formal training or certification on assessments & exercises concepts and 3+ years applied experience
• 3+ years of professional experience in technology risk and controls, cybersecurity consulting, audit, or compliance assessments, with hands-on exposure to PCI DSS
• Bachelor's degree in Computer Science, Management Information Systems, Accounting Information Systems, or a related field
• Comprehensive knowledge and practical experience across technology infrastructure domains and PCI DSS requirements
• Strong analytical, decision-making, time management, and prioritization capabilities with a detail-oriented approach to complex compliance matters
• Effective oral and written communication skills, with the ability to articulate complex technical concepts to diverse audiences including non-technical business partners
• Demonstrated ability to plan, coordinate, and execute across teams and functions to deliver quality outcomes within established timeframes
• Proven aptitude for upskilling and adopting new technologies in response to evolving business and regulatory requirements

Preferred qualifications, capabilities, and skills

• Experience working with a Qualified Security Assessor (QSA) firm or cybersecurity consulting organization
• Proficiency in reviewing and evaluating technical and software documentation to assess control suitability and compliance alignment
• Experience operating in heavily governed environments subject to compliance, regulatory, or risk-reduction controls, preferably within financial services
• Working knowledge of IT risk and process frameworks such as COSO, COBIT, NIST Cybersecurity Framework, or ITIL
• Familiarity with process-focused methodologies for IT activities including Change Management, Incident Management, and the Software Development Lifecycle (SDLC)
• Demonstrated interest and practical application of artificial intelligence, automation, or emerging technologies to enhance compliance and assessment processes

#CTC