Cybersecurity Risk Governance Principal

We are looking for a talented Cybersecurity Risk Governance Principal to join our team specializing in Systems/Information Technology for our Corporate organization. This is a remote role.

In this role, you will make an impact in the following ways:

• Lead the identification, assessment, and mitigation of cybersecurity risks by applying Cummins cybersecurity policies, risk management frameworks, and data privacy principles to protect critical business assets.
• Develop and execute cybersecurity strategies that proactively address emerging threats, reduce organizational risk, and strengthen the overall security posture of the business.
• Drive the application of industry frameworks and standards, including NIST, ISO, ITIL, and COBIT, ensuring cybersecurity controls and processes align with organizational objectives and compliance requirements.
• Serve as a trusted advisor to business and technology stakeholders, providing guidance on new and evolving technology solutions while balancing innovation with security and risk management.
• Influence and advocate for cybersecurity policy enhancements that improve governance, support evolving business needs, and reinforce enterprise-wide security practices.
• Lead financial planning activities, including Annual Operating Plan (AOP) development, budget management, forecasting, and resource allocation to ensure effective investment in cybersecurity initiatives.
• Build, develop, and lead high-performing teams through strategic recruiting, performance management, coaching, succession planning, and global team collaboration.
• Foster strong cross-functional relationships and a culture of accountability, ensuring adherence to Cyber, IT, and Corporate policies while delivering measurable business value through effective Business Relationship Management practices.

Responsibilities

To be successful in this role you will need the following:

Balances stakeholders - Anticipating and balancing the needs of multiple stakeholders.

Business insight - Applying knowledge of business and the marketplace to advance the organization’s goals.

Demonstrates self-awareness - Using a combination of feedback and reflection to gain productive insight into personal strengths and weaknesses.

Develops talent - Developing people to meet both their career goals and the organization’s goals.

Global perspective - Taking a broad view when approaching issues, using a global lens.

Manages complexity - Making sense of complex, high quantity, and sometimes contradictory information to effectively solve problems.

Persuades - Using compelling arguments to gain the support and commitment of others.

Plans and aligns - Planning and prioritizing work to meet commitments aligned with organizational goals.

Resourcefulness - Securing and deploying resources effectively and efficiently.

Strategic mindset - Seeing ahead to future possibilities and translating them into breakthrough strategies.

Facilitation - Guides group discussions or training by creating an active environment where questions are posed, perspectives are shared, and debates occur with the goal of gaining understanding, analyzing issues, resolving conflict, exploring solutions, or making decisions.

Cybersecurity Risk Management - Identifies and assesses the potential impact of Cybersecurity risks against established Cybersecurity industry frameworks, regulations and organizational policies to develop and implement risk mitigation strategies in alignment with business objectives.

Values differences - Recognizing the value that different perspectives and cultures bring to an organization.

Education, Licenses, Certifications:
College, university, or equivalent degree in Cybersecurity, Computer Science, or Information Technology, or related subject, or relevant equivalent experience required. This position may require licensing for compliance with export controls or sanctions regulations.

Experience:
Significant level of relevant work experience required. 5-7 years of experience

Qualifications

This role leads enterprise cybersecurity risk governance, connecting security functions and business stakeholders to prioritize and reduce strategic cyber risks in line with business objectives and risk appetite.

• Risk governance leadership: The manager administers the enterprise cyber risk governance process, ensures consistent risk identification and reporting, guides risk acceptance, and recommends treatment strategies and investment priorities based on risk reduction value and business impact.
• Cross-functional risk orchestration: The role integrates threat intelligence and emerging threat trends into treatment priorities, coordinates stakeholders across cybersecurity, legal, privacy, compliance, and business units, resolves roadblocks, and ensures treatment plans have owners, funding paths, and timelines. It also presents risk posture and business impacts to senior leadership and supports enterprise risk management committees.
• Qualifications and environment: Candidates need a bachelor’s degree in cybersecurity, information technology, or a related field; 5 to 7 years of cybersecurity experience, including 3 to 5 years in cybersecurity risk management or enterprise risk management; familiarity with NIST RMF, FAIR, or quantitative risk methods; and knowledge of threat intelligence, security operations, identity and access management, cloud security, privacy, legal risk, and regulatory requirements. Strong communication, analytical, organizational, and collaboration skills are required, while CISSP, CISM, or equivalent certification is preferred.

The Cybersecurity Risk Governance Manager will serve as the central orchestrator between Governance, BRI, Cyber Threat Intelligence, Cyber Operations, and Business stakeholders to ensure enterprise strategic cyber risks are understood, prioritized, and reduced through coordinated treatment strategies aligned with business objectives and risk appetite.

1. Enterprise Risk Governance:

   • Leads the operation and administration of the enterprise cyber risk governance process under the direction of Cybersecurity Governance leadership.

   • Ensure risks are consistently identified, assessed, categorized, and reported.

   • Facilitate risk acceptance governance and provide recommendations to decision-makers.

2. Strategic Risk Treatment Leadership:

   • Recommend enterprise-wide treatment strategies targeting root causes rather than individual issues.

   • Recommend risk reduction investment priorities based on risk reduction value and business impact.

3. Threat and Intelligence Integration:

   • Partner closely with BRI and Cyber Threat Intelligence to address emerging threats.

   • Translate threat trends, intelligence reports, and emerging risk drivers into strategic risk treatment priorities.

   • Assess how evolving threat activity impacts enterprise risk exposure.

4. Cross-Functional Orchestration:

   • Convene stakeholders from Cyber Ops, IAM, Infrastructure, Application Security, Compliance, Privacy, Legal, and Business Units.

   • Resolve roadblocks impacting risk reduction initiatives.

   • Ensure strategic treatment plans have accountable owners, funding paths, and timelines.

5. Executive Risk Communication & Reporting:
   • Present risk posture and treatment progress to senior leadership.
   • Translate technical cyber risks into business impacts (Financial, Operational, Regulatory, Reputational)
   • Support ERM & governance committees as Cybersecurity Risk Expert.
6. Risk Exception & Acceptance Governance:
   • Define and govern risk acceptance criteria, approval authorities, oversight requirements and exception management processes.
   • Establish and oversee the governance framework for risk acceptance and exceptions.

Cummins is an equal opportunity employer. Our policy is to provide equal employment opportunities to all qualified persons without regard to race, sex, color, disability, national origin, age, religion, union affiliation, sexual orientation, veteran status, citizenship, gender identity, or other status protected by law.