Head of Risk Management & Audit

Cyber & Information Security Risk & Controls SpecialistWe are seeking an experienced Cyber & Information Security Risk & Controls Specialist with proven project management capabilities to join our team. In this role, you will lead the risk evaluation, control design, assessment, and remediation activities across 2 to 3 active cyber workstreams. Supported by dedicated internal teams and subject matter experts, you will ensure our security controls align with industry standards, regulatory mandates, and enterprise risk appetite. Risk Identification & Mitigation: Lead risk assessments across core systems, applications, and processes. Collaborate with control owners to formulate effective remediation and risk treatment plans.Governance & Compliance Alignment: Ensure control activities align with firm-wide information security policies, regulatory requirements, and audit expectations.Testing & Readiness: Coordinate control testing, review evidence documentation, and prepare workstreams for internal and external cyber audits.Project Management & Workstream OversightMulti-Workstream Execution: Manage planning, execution, and delivery across 2–3 concurrent cyber and information security workstreams.Maintain comprehensive project plans, schedules, action items, and risk/issue logs (RAID).Partner closely with internal cybersecurity architects, IT engineering, compliance teams, and external vendor partners.Develop management dashboards, Key Risk Indicators (KRIs), and executive status updates highlighting progress, blockers, and residual risks.Facilitate structured knowledge transition and hand-off to downstream operational and support teams.Continuous Improvement: Qualifications Required Experience & EducationEducation: Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Business Administration, or related field (or equivalent practical experience).Experience: 5+ years of direct experience in information security, IT risk management, cyber compliance, or IT audit.Risk & Controls Acumen: In-depth knowledge of cybersecurity risk frameworks, internal controls assessment, threat/vulnerability management concepts, and audit readiness.Project Delivery: Demonstrated track record successfully managing complex security or technology initiatives involving multiple stakeholders and workstreams.Preferred Qualifications & Certifications (not required)Professional certifications in security, risk, or audit: Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Security Professional (CISSP).Project management certification: Project Management Professional (PMP), PMI-ACP, or Agile/Scrum certification.Experience working within enterprise environments or professional services networks.Core CompetenciesAnalytical Thinking: Ability to synthesize complex technical risks into clear, actionable business impacts.Stakeholder Management: Exceptional communication skills with the ability to influence technical and non-technical stakeholders across varying seniority levels.Strong organizational and prioritization capabilities, comfortably shifting between high-level project coordination and deep-dive control reviews.