AVP - Technology Governance, Risk, and Compliance

Our Company

Oaktree is a leader among global investment managers specializing in alternative investments, with more than $220 billion in assets under management. The firm emphasizes an opportunistic, value-oriented, and risk-controlled approach to investments in credit, equity, and real estate. The firm has more than 1,400 employees and offices in more than 25 cities worldwide.

We are committed to cultivating an environment that is collaborative, curious, inclusive and honors diversity of thought. Providing training and career development opportunities and emphasizing strong support for our local communities through philanthropic initiatives are essential to our culture.

For additional information please visit our website at www.oaktreecapital.com.

Role Summary

Oaktree is seeking a motivated and detail-oriented candidate for the role of AVP, Governance, Risk & Compliance within our cybersecurity program. This individual will report to the Vice President of Governance, Risk & Compliance and play an integral role in supporting the firm's security posture, regulatory obligations, and risk management activities across all business lines. The ideal candidate brings a foundational understanding of GRC principles, experience developing and tracking metrics, and a keen interest in applying risk-based thinking within a financial services environment.

Responsibilities

Governance

• Support the maintenance and continuous improvement of cybersecurity governance frameworks aligned with industry standards such as NIST CSF and ISO 27001.
• Assist in the drafting, updating, and organization of IT security policies, standards, and procedures to ensure alignment with regulatory and business requirements.
• Maintain and organize governance documentation within the firm's centralized platform to support audits, exams, and internal reviews.
• Coordinate control ownership tracking across business units to support visibility, accountability, and reporting consistency.
• Prepare materials for senior management, Legal, Compliance, and Audit stakeholders as needed.

Risk Management

• Support enterprise-wide cyber risk assessments, including data gathering, inherent and residual risk scoring, and documentation of control gaps and remediation activities.
• Maintain the IT Risk Register, ensuring it accurately reflects current threats, regulatory changes, and business priorities.
• Contribute to the third-party technology risk management program by assisting with vendor due diligence questionnaires, risk scoring, and ongoing monitoring activities.
• Develop, maintain, and enhance Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) to track control effectiveness, program health, and trend reporting for leadership.
• Produce regular metrics reports and dashboards that communicate risk posture in a clear and actionable format.

Compliance

• Support the firm's compliance activities across relevant regulatory frameworks, including MAS, CSCRF, IFSCA, GDPR, DORA, and CCPA.
• Assist in the preparation and response for internal and external audits, regulatory exams, and client due diligence requests.
• Contribute to SOC 1/2 audit readiness by supporting control validation, evidence collection, and documentation efforts.
• Assist in coordinating responses to external auditor requests, walkthroughs, and follow-up items.
• Support the control testing and self-assessment process to validate control effectiveness and maintain audit readiness.
• Track and process policy exception requests, ensuring compensating controls are properly documented and monitored.
• Monitor audit findings, track remediation progress, and assist in driving open items to closure.

Qualifications

• 10–15 years of experience in a GRC, risk, audit, or compliance-related role, preferably within financial services or a regulated industry.
• Demonstrated experience developing and maintaining risk or compliance metrics, KRIs, KPIs, or dashboards.
• Familiarity with common frameworks such as NIST CSF, NIST RMF, NIST 800 series, ISO 27001, or CIS Controls.
• Understanding of regulatory requirements applicable to financial services (e.g., GLBA, SEBI CSCRF, IFSCA, MAS).
• Strong problem-solving and organizational skills with a high attention to detail.
• Ability to analyze complex regulatory guidance and correlate it to operational controls and processes
• Effective written and verbal communication skills, with the ability to present findings clearly to both technical and non-technical audiences.
• Proficiency in Microsoft Office (Excel, PowerPoint, Word); experience with GRC platforms (e.g., AuditBoard, ServiceNow GRC) or data visualization tools is a plus.
• Bachelor's degree in Information Security, Business, Finance, or a related field preferred.
• Relevant certifications (e.g., CompTIA Security+, CISA, CRISC, or equivalent) are a plus but not required.

Equal Opportunity Employment Policy

Oaktree is committed to diversity and to equal opportunity employment. Oaktree does not make employment decisions on the basis of race, creed, color, ethnicity, national origin, citizenship, religion, sex, sexual orientation, gender identity, gender expression, age, past or present physical or mental disability, HIV status, medical condition as defined by state law (genetic characteristics or cancer), pregnancy, childbirth and related medical conditions, veteran status, military service,  marital status, familial status, genetic information, domestic violence victim status or any other classification protected by applicable federal, state and local laws and ordinances. This policy applies to hiring, placement, internal promotions, training, opportunities for advancement, recruitment advertising, transfers, demotions, layoffs, terminations, recruitment advertising, rates of pay and other forms of compensation and all other terms, conditions and privileges of employment.

This policy applies to all Oaktree applicants, employees, clients, and contractors.

Equal Opportunity Employment Policy

Oaktree is committed to diversity and to equal opportunity employment. Oaktree does not make employment decisions on the basis of race, creed, color, ethnicity, national origin, citizenship, religion, sex, sexual orientation, gender identity, gender expression, age, past or present physical or mental disability, HIV status, medical condition as defined by state law (genetic characteristics or cancer), pregnancy, childbirth and related medical conditions, veteran status, military service, marital status, familial status, genetic information, domestic violence victim status or any other classification protected by applicable federal, state and local laws and ordinances. This policy applies to hiring, placement, internal promotions, training, opportunities for advancement, recruitment advertising, transfers, demotions, layoffs, terminations, recruitment advertising, rates of pay and other forms of compensation and all other terms, conditions and privileges of employment. This policy applies to all Oaktree applicants, employees, clients, and contractors. Staff members wishing to report violations or suspected violations of this policy should contact the head of their department or Human Resources.

For positions based in Los Angeles

For those applying for a position in the city of Los Angeles, the firm will consider for employment qualified applicants with a criminal history in a manner consistent with applicable federal, state and local law.