IT Risk & Control Director - Cybersecurity

Description

Summary:

The Technology Risk & Control Director – Cybersecurity is a senior front-line Technology Risk leader responsible for providing risk insight, advisory support, and effective challenge across cybersecurity and information protection domains.

The role works collaboratively with Cybersecurity and Technology leaders responsible for establishing and maintaining standards, procedures, controls, metrics, and operational practices. The Technology Risk Director does not replace or assume those ownership responsibilities. Instead, this role helps leaders understand risk exposure, evaluate the effectiveness and sustainability of the control environment, identify emerging or systemic risk themes, and make well-informed risk decisions.

The position will provide risk expertise across Identity and Access Management (IAM), Privileged Access Management (PAM), Data Protection, Cloud Security, Vulnerability and Exposure Management, Application Security, Security Architecture, Cybersecurity Operations, and other evolving cybersecurity domains.

The leader will bring strong cybersecurity and technology risk experience, sound judgment, and the ability to translate complex technical conditions into business risk, control implications, risk trends, and clear executive insights.

Duties and Responsibilities:

Serve as a senior Technology Risk partner to Cybersecurity and Technology leadership, providing risk insight, advice, and constructive challenge across cybersecurity and information protection domains.

Build strong, collaborative relationships with Cybersecurity, Technology, Data, business-aligned technology teams, Independent Risk, Compliance, Legal, Privacy, Audit, and other enterprise stakeholders.

Provide risk insight across IAM, PAM, authentication and authorization, identity governance, Data Protection, Cloud Security, Vulnerability and Exposure Management, Application Security, Security Architecture, Cyber Operations, endpoint and network security, and cyber incident risk.

Partner with Cybersecurity and Technology control owners to assess risk associated with identity lifecycle management, privileged access, excessive or unauthorized access, service and non-human identities, entitlement structures, authentication, access certification, and segregation of duties.

Advise Cybersecurity and Technology leaders on risk considerations associated with cloud adoption and cloud-native technologies, including identity, privileged access, sensitive data, security configuration, workload protection, encryption, secrets management, and monitoring.

Provide independent risk perspectives to help Technology leaders understand how data security and protection practices, including encryption, key management, DLP, sensitive-data access, and information lifecycle controls, influence the broader technology risk profile.

Partner with Cybersecurity teams to interpret vulnerability and exposure information, helping translate technical conditions into potential business impact, risk concentration, prioritization considerations, and executive-level risk insight.

Provide risk input into Cybersecurity and Technology standards, procedures, metrics, KRIs, risk assessments, control assessments, risk acceptances, exceptions, issues, and remediation strategies, while preserving accountability with the appropriate Technology or Cybersecurity owner.

Analyze cybersecurity risk across domains to identify common themes, systemic conditions, risk concentrations, control dependencies, and emerging risks that may not be apparent when individual issues or metrics are viewed independently.

Help ensure cybersecurity findings, control deficiencies, exceptions, and other risk indicators are appropriately understood and represented in the broader Technology Risk profile.

Partner with issue and control owners on root-cause analysis, risk articulation, remediation strategies, risk acceptance, and closure considerations, providing risk perspective without assuming ownership for remediation or control execution.

Provide risk insight into cybersecurity metrics, KRIs, and risk appetite measures, helping distinguish indicators of actual risk exposure from operational performance, program delivery, or activity measures.

Translate cybersecurity conditions into potential business impact, including unauthorized access, data compromise, fraud or unauthorized money movement, service disruption, customer impact, financial loss, and regulatory exposure, where applicable.

Prepare and contribute to executive-level risk assessments, management and Board reporting, regulatory responses, issue updates, and decision materials, translating technical cybersecurity topics into clear risk exposure, business impact, trends, and decisions.

Participate in Cybersecurity and Technology governance forums as a collaborative risk partner, bringing forward risk trends, emerging concerns, cross-domain dependencies, and areas requiring leadership attention or risk decisions.

Maintain clear role boundaries within the three lines model by supporting Technology and Cybersecurity ownership of their standards, procedures, metrics, controls, and execution, while providing first-line Technology Risk insight and challenge and supporting effective engagement with Independent Risk and Internal Audit.

Monitor developments in cyber threats, technology architecture, regulation, industry practices, cloud technologies, identity, data protection, and emerging technologies to help Technology leaders anticipate changes to the organization's risk profile.

Lead and develop a high-performing Technology Risk team that demonstrates strong cybersecurity expertise, business acumen, collaborative partnership, sound judgment, and the ability to provide credible and actionable risk insights.

Perform other duties as assigned.

Basic Qualifications:

Bachelor's degree or equivalent level of work experience

10+ years in a related role

Preferred Qualifications:

• Significant experience working within a first-line technology risk, cybersecurity risk, information security risk, or comparable risk and control function in a financial institution or other highly regulated organization.
• Demonstrated knowledge across multiple cybersecurity disciplines, with particular experience in IAM/PAM, Data Protection, Cloud Security, Vulnerability Management, cybersecurity controls, or related security domains.
• Demonstrated experience operating within the three lines model and partnering effectively with Technology/Cybersecurity control owners, Independent Risk, Compliance, Internal Audit, and regulatory stakeholders.
• Experience advising senior leaders on cybersecurity and technology risks without assuming responsibility for the underlying operational process or control.
• Demonstrated ability to translate complex cybersecurity conditions into business risk, control implications, residual risk considerations, risk trends, and decision-oriented executive insights.
• Experience leading senior professionals and developing strong risk talent within complex, matrixed organizations.
• Significant experience working within a first-line technology risk, cybersecurity risk, information security risk, or comparable risk and control function in a financial institution or other highly regulated organization.
• Demonstrated knowledge across multiple cybersecurity disciplines, with particular experience in IAM/PAM, Data Protection, Cloud Security, Vulnerability Management, cybersecurity controls, or related security domains.
• Demonstrated experience operating within the three lines model and partnering effectively with Technology/Cybersecurity control owners, Independent Risk, Compliance, Internal Audit, and regulatory stakeholders.
• Experience advising senior leaders on cybersecurity and technology risks without assuming responsibility for the underlying operational process or control.
• Demonstrated ability to translate complex cybersecurity conditions into business risk, control implications, residual risk considerations, risk trends, and decision-oriented executive insights.
• Experience leading senior professionals and developing strong risk talent within complex, matrixed organizations.
• Deep understanding of Identity and Access Management and Privileged Access Management, including identity governance, authentication, authorization, MFA, privileged access, entitlement management, access certification, service/non-human identities, and identity lifecycle management.
• Strong understanding of Data Protection, including sensitive data protection, encryption, key management, DLP, access to sensitive information, and information lifecycle considerations.
• Strong understanding of Cloud Security, including identity and access, workload protection, infrastructure security, configuration, encryption, secrets management, and cloud governance.
• Strong understanding of Vulnerability and Exposure Management, Application Security, Security Architecture, endpoint and network security, Cybersecurity Operations, and incident-related risk.
• Working knowledge of recognized cybersecurity frameworks and practices such as NIST Cybersecurity Framework, NIST SP 800-53, NIST Zero Trust guidance, CIS Controls, and ISO/IEC 27001.
• Experience assessing risk within major public-cloud environments such as Microsoft Azure, Amazon Web Services (AWS), or Google Cloud Platform (GCP).
• Experience with risk assessments, RCSAs/control assessments, issue management, risk acceptance, remediation governance, control testing results, KRIs, audit engagement, and regulatory examinations.
• Demonstrated ability to identify systemic and aggregate risk themes across cybersecurity findings, metrics, control deficiencies, risk acceptances, exceptions, and other risk indicators.
• Strong executive presence with the ability to communicate cybersecurity risk effectively to senior management, Board-level audiences, regulators, Independent Risk, and Internal Audit.
• Demonstrated ability to provide constructive and credible challenge while maintaining collaborative relationships and clear ownership boundaries.
• Strong written and verbal communication skills with the ability to translate complex cybersecurity concepts into concise, business-oriented risk insights and recommendations.
• Relevant professional certifications such as CISSP, CISM, CRISC, CISA, CCSP, or comparable cybersecurity/risk credentials preferred.
• Exempt Status: (Yes   = not eligible for overtime pay) ( No   = eligible for overtime pay)
• Yes
• Workplace Type: Office
• Our Approach to Office Workplace Type
• Certain positions outside our branch network may be eligible for a flexible work arrangement. We’re combining the best of both worlds:  in-office and work from home. Our approach enables our teams to deepen connections, maintain a strong community, and do their best work. Remote roles will also have the opportunity to come together in our offices for moments that matter. Specific work arrangements will be provided by the hiring team.