Director of Cybersecurity & Resilience

SUMMARY

Reporting to the Chief Information Officer, the Director of Cybersecurity & Resilience is responsible for leading the organization's cybersecurity and information technology risk management functions, including thirty-party risk and business continuity management. The Director establishes, operates, and continuously improves a risk-based cybersecurity program that protects information assets, supports regulatory compliance, strengthens cyber resilience, and provides management and governance committees with clear visibility into cybersecurity and IT risk.

ESSENTIAL DUTIES AND RESPONSIBILITIES

• Accountable for developing, maintaining, and executing the organization's cybersecurity strategy, program, policies, standards, and roadmap in alignment with organizational objectives, risk appetite, applicable laws and regulations, and recognized frameworks such as the NIST Cybersecurity Framework, NIST 800-53, ISO 27001/2, and other financial industry guidance, where applicable.
• Accountable for the effective delivery of Cybersecurity Operations (CyberOps), including security monitoring, detection, investigation, escalation, containment, recovery, and the secure configuration, hardening, testing, deployment, and maintenance of cybersecurity technology platforms.
• Lead the IT and cybersecurity risk management process, including risk identification, assessment, treatment, acceptance, monitoring, and reporting. Maintain current risk assessments and risk registers, establish action plans, and escalate exposures that exceed approved risk thresholds.
• Maintain a risk-based vulnerability and threat management program covering internal and external scanning, penetration testing, configuration weaknesses, threat intelligence, remediation validation, exception management, and timely escalation of overdue or high-risk findings.
• Serve as a leader of the organization's incident response team for cybersecurity events and suspected breaches of confidential information. Maintain and test cybersecurity incident response plans, playbooks, communication protocols, evidence-handling practices, and escalation procedures; coordinate lessons learned and corrective actions.
• Oversee cybersecurity requirements for identity and access management, including privileged access, multifactor authentication, periodic access reviews, segregation of duties, joiner-mover-leaver controls, service accounts, and timely remediation of inappropriate access.
• Establish cybersecurity architecture, secure configuration, and system hardening requirements. Identify and measure cybersecurity and IT risk before material technology changes, new products, system implementations, cloud adoption, integrations, or significant investments are approved or deployed.
• Accountable for managing and maintaining the third-party risk management lifecycle, including due diligence, risk assessment, control evaluation, contractual security requirements, ongoing monitoring, issue management, incident coordination, and termination or transition risk.
• Accountable for managing and maintaining the business continuity management function including technology resilience, business continuity, disaster recovery, backup security, and recovery testing. Ensure cyber scenarios, including destructive attacks and prolonged technology outages, are incorporated into exercises and remediation plans.
• Oversee technical and administrative safeguards for sensitive and non-public information, including encryption, data loss prevention, secure transmission, logging, monitoring, and other information protection controls. Coordinate security requirements with privacy, legal, compliance, and business stakeholders.
• Analyze and monitor cybersecurity and IT risk metrics, key risk indicators, key performance indicators, control effectiveness measures, incidents, vulnerabilities, exceptions, and remediation status. Identify trends and provide clear, decision-useful reporting to Senior Management and appropriate governance committees.
• Coordinate cybersecurity and IT risk support for internal audits, external audits, regulatory examinations, independent assessments, penetration tests, and control reviews. Recommend and initiate corrective actions, track findings to validated closure, and maintain supporting evidence.
• Assist in the coordination of the cybersecurity awareness and education program, including role-based training, phishing education and testing, targeted communications, and reporting. Promote prompt reporting of suspicious activity and reinforce employee responsibilities for safeguarding information.
• Maintain accurate and current cybersecurity and IT risk policies, standards, procedures, control documentation, diagrams, inventories, risk records, exceptions, testing evidence, and management reports.
• Develop and manage the cybersecurity budget, resource plan, and investment priorities based on risk, regulatory expectations, control effectiveness, technology lifecycle considerations, and the cybersecurity strategy.
• Participate on the organization's Technology Committee and other governance committees as required. Present material cybersecurity and IT risks, incidents, control gaps, investment needs, and remediation progress in clear business terms.
• Provide supervision and support to assigned cybersecurity personnel and oversee cybersecurity service providers. Establish responsibilities, performance expectations, escalation requirements, cross-training, succession coverage, and accountability for deliverables.
• Maintain awareness of changes in cyber threats, attack techniques, regulatory expectations, and security practices. Recommend proportionate improvements to cybersecurity controls, processes, staffing, and technologies based on risk and lessons learned.
• Complete all internal Company training as assigned and required.
• Adhere to the Company’s privacy and data security policies including but not limited to safeguarding of sensitive information and complying with relevant regulations to protect non-public information.
• Exhibit the ability and desire to embrace and enhance the Company culture.

Consider this description to be the foundation of your job, not its boundaries. Expect to participate in internal and external training sessions and activities not described here which enhance the quality of service to the client.

SUPERVISORY RESPONSIBILITIES

Directly manages assigned employees in the Cybersecurity and Business Resilience functions and oversees cybersecurity and business resilience service providers. Carries out supervisory responsibilities in accordance with the organization's policies and applicable laws. Responsibilities include interviewing, hiring, and training employees; planning, assigning, and directing work; appraising performance; rewarding and disciplining employees; addressing complaints; and resolving problems.