Develops and standardizes processes and procedures relating to IT Security risk and change control across the technology organization, balances risk vs. business needs while ensuring policies are implemented in accordance with corporate-wide policies and external regulatory obligations. Reviews exception requests and monitors action plans that are developed and implemented to address any non-compliance with policy requirements.