Norma J. Hernandez
Riverview,FL
Overview
28
28
years of professional experience
1
1
Certification
1
1
Language
Summary
Risk management professional prepared to excel in this role. Proven ability to identify, assess, and mitigate risks, ensuring organizational resilience. Strong focus on collaborative teamwork and delivering results under changing conditions. Adept at developing risk management strategies, conducting thorough analyses, and implementing effective controls. Recognized for reliability, adaptability, and strategic thinking.
Work History
IT Risk Manager – Operations & Technology
Citi
Tampa, FL
09.2009 - Current
- In-depth knowledge of risk assessment methodologies, risk identification techniques, and risk mitigation strategies.
- Drove technology governance by deploying COBIT framework to optimize risk management and operational effectiveness.
- Proficient in analyzing complex data, identifying trends, and developing risk mitigation plans.
- Strong understanding of regulatory requirements and industry best practices related to risk management.
- Guided governance and facilitated the execution of the Manager Control Assessment for the Operations Tech Team, assessing and approving risks associated with business changes.
- Ensured quality, completeness, and accuracy in implementing the Control Framework, including the Risk Control Policy, Control Standard, Issue Management Policy, Lesson Learned Policy, and Control Inventory.
- Successfully managed timely closure of MRA’s Consent Order Commitments and IA Findings.
- Manage a team of Six Business Risk Officers responsible for issue management, partnering with control and process owners to recommend holistic corrective actions and improvements, provide guidance to ensure appropriate escalation in accordance with Issue Management and Escalation Policies.
- Allocate resources to identify, assess, escalate, and manage risk exposures across Risk Categories (Operational Compliance, Strategic, Reputational), including material, emerging and concentration risks in accordance with enterprise Policies and the establishment of Key Indicators to monitor risk exposures.
- Assisted in directing teams to implement Lessons Learned Policy, monitoring control breaches and sharing insights across business units for process improvements to reduce recurrence of similar events and mitigate risk exposure.
- Support review and challenge, within the FLUs, on the effective design and management of controls to mitigate risks as required by the Control Standards, including implementation and operation, conducting the control monitoring, handling deficiencies, and escalating issues for resolution.
- Assess Tech, Cyber Risk Appetite, and monitor exposures against this in accordance with enterprise requirements.
- Assess the risks associated with New Activities and changes to the Business, ensuring these are clear and adequately mitigated to an acceptable tolerance level.
- Perform Independent Internal Risk and Controls reviews to appropriately assess risks for senior management to make business decisions by Senior Management, demonstrating particular consideration for the firm's reputation and safeguarding Citigroup, its clients, and assets, by driving compliance with applicable laws, rules, and regulations, adhering to Policy.
- Lead and coordinate testing of controls and challenge sampling to ensure the appropriate level of coverage for Operational & Technology Risk program.
- Collaborate and liaise as a trusted partner with First, Second and Third lines of defense for addressing Operational Risks.
- Prepared and presented risk reports to senior management, emphasizing key risks, trends, and actionable recommendations.
- Led successful technology audits, emphasizing the assessment of key controls during audits and the timely addressing of audit requests and findings.
Internal Controls Manager
Citi
Tampa, FL
05.2021 - 09.2021
- Successfully managed Risk & Control program for Operations Tech Team by ensuring in taking a risk-based approach and tying it to Citi Policy. Drove compliance matters related to Audits, Issue/Corrective Action Plans (CAPs)/Risk Exceptions, MCA framework, Privileged Access, and Functional ID’s.
- Assisted GPA managers in managing resources and forecasting for Third Party Resources.
- Created and implemented a coordinated EERs review process across Global Production Assurance for automation and to reduce number of past due reviews, while ensuring managers performed effective reviews in line with CISS policy and eliminating entitlements no longer needed by resource or were not part of their role.
- Successfully managed Risk & Control program for Operations Tech Team by ensuring in taking a risk-based approach and tying it to Citi Policy. Drove compliance matters related to Audits, Issue/Corrective Action Plans (CAPs)/Risk Exceptions, MCA framework, Privileged Access, and Functional IDs.
- Created and implemented a coordinated EERs review process across Global Production Assurance for automation and to reduce the number of past due reviews, while ensuring managers performed effective reviews in line with CISS policy and eliminating entitlements no longer needed by resource or were not part of their role.
- Led site operations in Tampa for the Operations Tech Team, overseeing daily functions and team performance.
- Onboarded over 100 applications to the production management environment for L1/L2/L3 support.
- Implemented incident deflection program by creating Collaborate User Communities for high-incident applications, such as OneReset, resulting in a 56% reduction in incidents in the self-help area.
- Lead and manage team of Seven resources located in Chile Technology Center.
- Responsible for onboarding over 100+ applications to Production Management environment for L1/L2/L3 support.
Audit Management Officer – EO&T Risk & Control
Citi
Tampa, FL
11.2011 - 05.2013
- Managed CTI SOX/SOC2 program, liaised with regional CTI SOX leads and external reviewers to complete reviews and resolve potential exceptions.
- Maintenance of SOX issues (creation and resolution), provide guidance on the SOX criteria and identifying areas of improvement to strengthen the program while adhering to SOX 404 compliance.
- Maintained SOX issues through creation and resolution, guided on SOX criteria, and identified improvements to strengthen the program while adhering to SOX 404 compliance.
- Create metric reports for review with senior management of External Regulatory Reviews of all EO&T Functions.
- Created External/Regulatory guidance document for Regions/Functions to use for reporting Key Regulatory reviews for review with Senior Management.
- Developed External/Regulatory guidance document for regions/functions to facilitate reporting of key regulatory reviews to senior management.
- Created and Implemented process document in Spanish for training module of Issue Life Cycle Management and facilitated training.
- Created and published Risk Management new hire deck as a result of VOE program to enhance new employee transition into new role.
IT Business Senior Analyst
Citi
Tampa, FL
07.2004 - 10.2011
- Successfully manage department Book of Work to ensure development project delivery were aligned to the organization strategy.
- Conducted research, developed, and prepared monthly operational reports for review with senior management.
- Develop domain new hire training material and facilitate training sessions.
- Oversaw department compliance cycle and collaborated closely with the embedded control officer, BISO, and staff to achieve compliance and risk management initiatives. Monitored CTMP-S and CISS standards for updates and communicated changes to the department.
- Supported compliance activities including internal audits, quarterly RCSA, ICQ reviews, and risk acceptance processes.
- Assisted and collaborated closely with the Internal Control Risk Management Office to review and develop workflows in the Technology Development Life Cycle (TDLC) process.
- Served as Continuity of Business Recovery Coordinator, developed business recovery COB plans, coordinated and scheduled call tree testing, created COB plans for strategic vendors, and participated in data center testing activities.
- Facilitated CTO Business Office Forum meetings and collaborated with key CTO functional areas to communicate the organization's goals and strategy effectively.
Business Analyst Telecommunications
Citigroup
Tampa, FL
06.1998 - 06.2004
- Manage the Verizon portfolio for telecom circuit orders for all Citi North America locations.
- Maintained circuit inventory in Access database to ensure accurate tracking and availability.
- Liaison between Citi Procurement and Telecom vendors.
- Served as liaison between Citi Procurement and telecom vendors to facilitate communication and resolve issues.
- Assist in the process and review of Request for Proposal for Telecom bids.
- Resolved billing issues and answered client questions to enhance service satisfaction.
- Worked and supported department managers to streamline Telecom processes and standards.
- Assist in the Audit Tracking Policy Exceptions in Access database.
- Facilitated communication between Citi and Telecom vendors to ensure effective collaboration.
- Update department policy and procedural manuals.
Education
Master of Business Administration Degree -
UNIVERSITY OF PHOENIX
Tampa, FL01-2009
Bachelor of Science - Business Administration
UNIVERSITY OF PHOENIX
Tampa, FL01-2007
Skills
- Over 25 years of experience in financial and banking organization
- 10 years of Risk Management, Audit and Governance in Information Systems
- Transformational leadership
- Executive presence
- Communication and collaboration
- Adaptability to challenges
- Independent and team-oriented
- Audit coordination
- Enterprise risk management
- Risk mitigation strategies
- Emerging risks identification
- Governance, risk, and compliance software
Certification
Introduction to Program Management completed 2010, Information Security Officer Assessment 2010
Skills Summary
Bilingual: Proficient in English and Spanish
Training and Certifications
- Advance course in Power Point completed in 2008
- Advance course in Excel completed in 2008
- Risk Management Training completed in 2005
- Leading Effective Meetings completed in 2005
- Advanced Communications completed in 2005
- Business Information Security training completed in 2004
- Continuity of Business training completed yearly since 2004
Timeline
Internal Controls Manager
Citi
05.2021 - 09.2021
Audit Management Officer – EO&T Risk & Control
Citi
11.2011 - 05.2013
IT Risk Manager – Operations & Technology
Citi
09.2009 - Current
IT Business Senior Analyst
Citi
07.2004 - 10.2011
Business Analyst Telecommunications
Citigroup
06.1998 - 06.2004
Bachelor of Science - Business Administration
UNIVERSITY OF PHOENIX
Master of Business Administration Degree -
UNIVERSITY OF PHOENIX