About the role
We are hiring for a large financial services client. You will help run the supplier cybersecurity risk program for a large financial services client. You run the operational side of the program, from audit findings to supplier requirements and assessment questions.
What you will do
Manage audit and regulatory findings and their remediation plans
Support internal audit and examiners
Maintain the security requirements suppliers must meet and the assessment questions used to test them
Keep both aligned to security standards and industry frameworks, such as NIST
What you bring
8+ years in cyber risk or GRC, with 4+ years in third party risk
Ownership of audit and regulatory findings and remediation plans
Experience supporting internal audit and examiner requests
Experience maintaining supplier security requirements and assessment question sets mapped to NIST CSF, NIST 800 53, and ISO 27001
Leadership and influence skills
Nice to have
Bank regulator exam experience with the OCC, FRB, or FFIEC
Familiarity with FS ISAC and Shared Assessments (SIG)
Program or operating model design
Preferred certifications
CTPRP, CISA, CISSP, CISM, CRISC. Regulated bank experience is highly valued.
Background we look for
Experience in a large financial services or other regulated enterprise (bank, insurer, card issuer, asset manager) is strongly preferred. Consulting experience from a Big 4 firm or managed security provider is welcome when you were embedded with an enterprise team.