ED, Head of IT Risk and Cyber Controls

Our client is a global bank who are scaling up their IT risk and cyber controls program, and therefore seeking an ED of IT Risk and Cyber Controls.

Its central Control Office makes sure risk and control frameworks are applied consistently across the division, and it is building out its first-line testing and monitoring program.

This is a senior individual contributor role for a hands-on controls specialist. You'll run the IT, data and cyber controls testing program yourself, with direct visibility to senior management, 2nd line risk and internal audit. It suits someone who wants to shape a program without taking on people management.

The Role

You will plan and run risk-based testing and monitoring of cybersecurity, data management and technology controls across the Americas.

Key responsibilities include:

• Designing and running risk-based control testing and monitoring routines, including walkthroughs, workpapers and results reporting
• Assessing how well controls are designed and how well they work in practice, then recommending improvements to the control environment and the testing methodology
• Leading deep dives, root cause analysis and process mapping, and driving remediation through to validated closure
• Making sure the program meets regulatory requirements, including NYDFS Part 500, and recognized frameworks such as NIST CSF / 800-53, ISO 27001 and the CRI Profile

What We're Looking For

• 8+ years in IT, cyber or technology risk and controls, ideally in a first line of defense role within financial services
• Proven experience implementing a risk and control framework yourself, not just testing against one
• Hands-on knowledge of NYDFS 500 and control frameworks such as NIST, ISO 27001, CRI Profile, COBIT or FFIEC
• Strong documentation and communication skills; CISA, CRISC, CISM, CISSP or CIA a plus