Director Cybersecurity Operational Risk Oversight

As the Director of Operational Risk Management Oversight - Cybersecurity Risk, you will provide independent oversight, review, and challenge of cybersecurity related risks and collaborate with key stakeholders across the enterprise ensuring material risks within these groups are well defined and managed appropriately.

Primary responsibilities will include:

• Leading a team of three in independent oversight, review, and challenge of risk management activities within the cybersecurity first line of defense. This includes evaluating the effectiveness of their formal risk program activities including but not limited to: Risk and Control Self-Assessments, issues management, controls management, new business initiative risk assessments.

• Serving as an advisor to first line risk partners on complex risk issues and challenges, while identifying and assessing aggregate enterprise-wide risks. Collaborating with key stakeholders, including all three lines of defense, escalating emerging risk issues that require remediation and working directly with stakeholders while driving accountability. Maintaining strong relationships with all three lines of defense, as well as the regulatory agencies.

• Understanding the external environment, including emerging risks within the industry and the priorities of the regulatory agencies. Determining how these changes affect the risk profile of the enterprise and working with appropriate stakeholders to ensure mitigation strategies are underway.

• Participating in the cybersecurity incident response activities to ensure risks are accurately assessed in real time and mitigating actions are appropriate. Post incident, leading or participating in root cause analysis and opining on next steps.

• Leading targeted risk assessments on emerging issues to provide an independent opinion on the impact on the enterprise.

• Operating within existing governance structures with an eye towards making these processes more efficient and effective. Managing applicable policy and program governance, while performing assurance activities to assess corporate wide compliance.

• The role may be co-located as needed with the relevant business and must be actively engaged to support the business with providing domain-relevant advice, monitoring, and credible expert challenge to ensure the independent Operational Risk Management Program is effectively implemented.

Required Experience, Skills and Competencies:

• 8 years demonstrated cybersecurity domain expertise
• 4 years risk management experience from working in the financial services industry
• Expert knowledge of cybersecurity risks and controls
• Experience in a financial services organization that is under strong regulatory oversight and scrutiny
• Ability to develop and maintain high impact relationships with senior executives
• History of developing and leading a team
• Decisiveness and sound judgment on a consistent basis
• Capacity to challenge status quo
• Influencing and conflict resolution skills
• Excellent business writing skills
• Proven leadership and management skills in a professional environment
• Proficient use of MS Word, MS Excel and PowerPoint and Visio

Education

• Bachelor’s degree Required
• Certifications Preferred: CISSP, CISM, CISA, Certified in Risk and Information System Control or other relevant risk certifications

Hours and Work Schedule

Hours per Week: 40

Work Schedule: Monday-Friday

Pay Transparency

The salary range for this position is $178,000 - $220,000 per year, plus an opportunity to earn an annual discretionary bonus. Actual pay is based on various factors including but not limited to budget, the work location, and relevant skills and experience.

We offer competitive pay, comprehensive medical, dental and vision coverage, retirement benefits, maternity/paternity leave, flexible work arrangements, education reimbursement, wellness programs and more. Note, Citizens’ paid time off policy exceeds the mandatory, paid sick or paid time-away policy of every local and state jurisdiction in the United States. For an overview of our benefits, visit