Senior AI Risk, Controls, and Security Analys
Join Commercial Bank of California as a senior professional working remotely from United States. Explore the role, benefits, and apply in one place.
Job Description
Senior AI Risk, Controls & Security Analyst
Location: United States
Job Type: Full-Time | Non-Exempt | Remote/Hybrid Eligible
Salary Range: $50.00 – $63.00 per hour
About Commercial Bank of California
Commercial Bank of California (CBC) is the largest Latino-owned bank in California and a certified Minority Depository Institution (MDI). Headquartered in Irvine and founded in 2003, CBC is one of the largest privately held banks in the state, with over $4 billion in assets as of November 2026.
We are a purpose-driven financial institution committed to building long-term relationships and delivering innovative, personalized banking solutions. Our leadership reflects the diverse communities we serve, and our mission is rooted in empowering entrepreneurs, business owners, and community leaders to thrive.
As a certified MDI, CBC is proud to play a vital role in advancing financial inclusion and economic opportunity. We believe in a higher vision for banking—one that prioritizes trust, collaboration, and community impact. Join us and be part of a team that’s redefining what it means to be a community-focused, relationship-driven bank that puts people over profits.
Job Summary
We are seeking an AI-native professional in risk, controls, fintech security, and information security to support the Bank’s governance, risk, compliance, and embedded banking programs. This role combines hands-on banking control assurance with security assessment of fintech platforms, products, system integrations, APIs, data flows, and supporting operational controls.
The Senior Analyst will perform and support fintech and embedded banking security assessments, ongoing and annual user access reviews, production readiness evaluations, remediation tracking, and FDICIA and related control testing when assigned based on business need, qualifications, and approved testing responsibilities. The position will maintain audit-ready workpapers and control documentation; assess information security, technology, third-party, and AI-related risks; and support audits, regulatory examinations, and applicable governance reporting.
The role serves as an Information Security liaison for the Bank’s fintech and embedded banking initiatives, coordinating with internal business units and applicable service providers. The position provides security and control-assurance recommendations while business ownership, transaction processing, compliance determinations, fraud disposition, and accounting decisions remain with the designated accountable functions.
The successful candidate brings banking or financial services experience in auditing, information technology, information security, cybersecurity, technology risk, fintech, or GRC, and demonstrates an AI-first working style: identifying repeatable work, designing controlled AI-assisted workflows, validating outputs against authoritative evidence, and retaining accountable human review.
Essential Duties and Responsibilities
Fintech and Embedded Banking Security and Control Assurance
Serve as the Information Security liaison for the Bank’s fintech and embedded-banking program.
Perform security risk assessments for each component, provider, integration, product, and material change throughout design, contracting, implementation, testing, production launch, operation, and decommissioning.
Review end-to-end architecture and data flows across Bank-managed, FIS-managed, and other provider-managed environments.
Evaluate API security, authentication, authorization, encryption, certificates, secrets, service accounts, file transfers, privileged access, transaction workflows, logging, monitoring, retention, resilience, and incident-response controls.
Develop and maintain a shared-responsibility matrix identifying security and operational-control ownership among the Bank, FIS, fintech partners, and other service providers.
Establish component-level security-readiness criteria and provide documented security recommendations before production deployment or material changes.
Coordinate testing and remediation of security findings and ensure unresolved material risks are formally escalated for acceptance by the appropriate authority.
Maintain audit-ready architecture records, risk assessments, due diligence evidence, control matrices, access reviews, testing results, findings, risk acceptances, remediation records, and production-readiness decisions.
Provide management and applicable governance committees with reporting on component readiness, material security risks, provider findings, control gaps, incidents, and remediation status.
AI-Enabled Control Assurance and FDICIA Testing, as Assigned
- When assigned, perform FDICIA, IT general control, information security, and cybersecurity compliance control testing in accordance with approved testing procedures, schedules, and defined testing responsibilities.
- Conduct control walkthroughs; evaluate control design and operating effectiveness; obtain complete populations; select or validate samples; inspect evidence; document exceptions; and prepare clear, reproducible workpapers.
- Use approved AI and automation tools to organize evidence, compare populations, identify anomalies or missing documentation, draft testing narratives, and prepare preliminary summaries for human review.
- Validate AI-assisted results against authoritative source evidence before reliance, escalation, or distribution. Clearly document data sources, assumptions, prompts or logic used, reviewer decisions, and final conclusions when required.
- Track deficiencies, management responses, corrective action plans, due dates, retesting, and closure evidence. Escalate overdue or unsupported remediation.
- Maintain appropriate separation between control ownership, control execution, second-line testing, and independent Internal Audit responsibilities.
User Access Review and Identity Governance
- Coordinate ongoing and annual user access reviews for business applications, Active Directory and Entra ID groups, cloud platforms, network devices, databases, hypervisors, privileged accounts, service accounts, shared accounts, and third-party access.
- Reconcile system-generated access populations to authoritative employee, contractor, and identity records; investigate incomplete, duplicate, orphaned, dormant, excessive, or unsupported access.
- Assess access against job responsibilities, least privilege, segregation of duties, approved access, and privileged-access requirements.
- Use approved AI, data analysis, and automation capabilities to normalize entitlement data, detect outliers, prioritize reviewer attention, generate review packages, and monitor completion.
- Document reviewer decisions and management acknowledgments; track access removals and modifications to verified completion; retain complete audit evidence.
- Perform or support callback reviews of administrator activities against approved access and change requests.
Governance, Risk, Compliance, and Audit Support
- Support information security and cybersecurity risk assessments, control self-assessments, policy reviews, exception management, AI risk assessments, and regulatory or industry framework mapping.
- Maintain control inventories, testing documentation, risk and issue records, procedures, and evidence repositories in an audit-ready condition.
- Support internal and external audits, FDIC and other regulatory examinations, and management requests by gathering evidence, responding to inquiries, and tracking follow-up items.
- Prepare concise dashboards, trend analyses, committee materials, and management reporting on control effectiveness, access-review status, open findings, and remediation progress.
- Monitor relevant changes in FFIEC guidance, FDIC and DFPI expectations, GLBA, NACHA, PCI DSS, and Bank policies as assigned.
Information Security Operations and Cross-Training
- Analyze and follow up on alerts and escalations from security monitoring systems and managed security service providers under established procedures.
- Support security awareness activities, social engineering testing, remedial training, newsletters, and reporting.
- Cross-train as an analyst or backup trainee for selected controls and platforms supporting data loss prevention, AI Detection and Response, SaaS security, endpoint security, cloud security, network security, server and database security, e-mail security, application and API security, identity security, SIEM/SOAR, and privileged access management.
- Assist with security procedures, documentation, information disposal activities, and other duties assigned to preserve team resilience.
Minimum Qualifications
- Bachelor’s degree in information systems, cybersecurity, computer science, accounting, auditing, risk management, business, or a related discipline; equivalent relevant experience may be considered in accordance with Bank policy.
- Minimum five years of experience in a banking, financial-services, or fintech environment, with roles in IT audit, information technology, information security, or cybersecurity.
- Hands-on experience evaluating controls, evidence, and exceptions. Experience with FDICIA, SOX-style ITGC testing, user access reviews, access certification, or identity governance is strongly preferred.
- Demonstrated practical use of generative AI, analytics, automation, or scripting to improve analysis, documentation, testing, evidence collection, reporting, or workflow execution.
- Working knowledge of access management, change management, computer operations, vulnerability management, logging and monitoring, third-party risk, and information security controls.
- Knowledge of relevant banking, payment, privacy, and security requirements or guidance, including FFIEC, FDIC, DFPI, GLBA, NACHA, PCI DSS, and applicable Bank policies, commensurate with assigned responsibilities.
- Ability to communicate technical and control matters clearly to business owners, IT staff, management, auditors, vendors, and regulators.
- Working knowledge of API security, system integrations, authentication and authorization, encryption, service accounts, privileged access, logging and monitoring, secure data transfer, and third-party security controls.
- Ability to review architecture diagrams, data flows, interface specifications, penetration-test reports, vulnerability findings, and other technical or control-assurance evidence.
- Experience coordinating findings and remediation across business, technology, risk, compliance, operations, and service-provider stakeholders.
- Working knowledge of technology controls supporting banking, payments, fintech, or customer-facing financial services.
Preferred Qualifications
- CISA, CRISC, CISM, CISSP, Security+, CEH, or other relevant audit, risk, security, cloud, or AI governance credential.
- Experience with Microsoft Copilot or comparable enterprise AI assistants, Power Automate or other workflow tools, Excel/Power Query, Power BI, SQL, Python, or similar analysis capabilities.
- Experience with GRC, identity governance, privileged-access, vulnerability-management, SIEM, cloud-security, data-protection, or security-awareness platforms.
- Experience with AI governance frameworks or practices, such as AI system inventories, AI risk assessments, control testing, or monitored use of AI agents.
- Experience assessing fintech, embedded-banking, Banking-as-a-Service, payment, digital-banking, or customer-facing financial platforms.
- Experience reviewing API-based integrations, cloud-hosted services, transaction-processing systems, payment platforms, or provider-to-provider data flows.
- Experience developing shared-responsibility matrices, security-readiness criteria, control matrices, data-flow inventories, or production go-live assessments.
Benefits & Perks
- Competitive employer contribution to medical, dental and vision coverage
- 401k plan with employer match
- Flexible Spending Accounts (FSA) and Dependent Care Accounts
- Employee Assistance Program (EAP)
- Employer provided Calm subscription
- Employer provided mental health benefits through Teladoc
- Life, AD&D and disability insurance
- Minimum 15 Days of Vacation, 11 Paid Federal Holidays, Paid Time off to Volunteer
- Online discount program
- Tuition Reimbursement Program
Join Our Team!
- Submit your resume to Apply to Your Position Here
Equal Employment Opportunity & Accommodations
Commercial Bank of California is proud to be an Equal Employment Opportunity employer. We are committed to creating an inclusive environment for all employees and applicants. All qualified individuals will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity or expression, national origin, disability, protected veteran status, or any other legally protected characteristic.
We evaluate applicants fairly and equitably, including those with criminal histories, in accordance with applicable federal, state, and local laws.
Commercial Bank of California is also committed to providing reasonable accommodations to individuals with disabilities. If you require a reasonable accommodation during the application or interview process, please contact us at hrrecruiting@cbcal.com with the nature of your request and your contact information.
Recruitment Policy
Commercial Bank of California does not accept unsolicited resumes from any source other than directly from a candidate. Any unsolicited resumes sent to CBC, either directly or indirectly, will be considered the property of Commercial Bank of California.
We will not pay a fee for any placement resulting from the receipt of an unsolicited resume. To submit candidates for consideration, recruiting agencies must have a valid, written, and fully executed agreement with Commercial Bank of California. Without such an agreement in place, no agency submissions will be accepted or compensated.
Requirements
- Perform and support fintech and embedded banking security assessments
- Maintain audit-ready workpapers and control documentation
- Assess information security, technology, third-party, and AI-related risks
- Support audits, regulatory examinations, and applicable governance reporting
- Serve as an Information Security liaison for the Bank's fintech and embedded banking initiatives
- Provide security and control-assurance recommendations
- Bring banking or financial services experience in auditing, information technology, information security, cybersecurity, technology risk, fintech, or GRC
- Demonstrate an AI-first working style
Benefits
- 401k Matching
- Health Insurance
- Paid Time Off
- Performance Bonus
- Remote Work
- Retirement Plan
- Vision Insurance
Skills
Ready to Apply?
Join Commercial Bank of California today
More AI Risk & Controls roles you might like
Discover similar opportunities from companies that are also hiring remotely.
Explore more remote openings
Browse fresh listings from our global community of remote-friendly teams.
