Managing Director, Cyber Risk & Third-Party Risk Management

Who we are looking for The Managing Director, Cyber Risk & Third-Party Risk Management, is responsible for leading the enterprise cyber risk management program and maintaining effective governance over cyber risk identification, assessment, monitoring, reporting, and remediation activities, including those of third parties. The role owns the Cyber Risk Framework, Cyber Controls Assurance Program (CCAP), issue management, control governance, and management of first- and second-line audits and assessments. Why this role is important to us This role serves as the enterprise authority for cyber risk and third-party cyber risk management practices and provides leadership insights regarding aggregate cyber risk exposure, control effectiveness, and remediation performance. What you will be responsible for Cyber Risk Framework Influence enhancements to and operationalize Cyber Risk Management Framework including cyber risk taxonomy, methodologies, risk appetite alignment, risk reporting standards, assurance methodologies, testing standards, and control evaluation practices. Ensure cyber risks are consistently identified, assessed, monitored, escalated, and reported across the organization. Support risk aggregation, risk quantification, and emerging risk assessment activities. Lead the development, maturation, and maintenance of comprehensive cyber risk metrics and Key Risk Indicators (KRI) that provide meaningful, actionable insight into residual cyber risk, emerging trends, control maturity, and risk reduction outcomes, supporting executive, board, and regulatory oversight and risk-based decision making. Oversee assessment execution, quality assurance, challenge, and consistency across cybersecurity process areas and control domains. Monitor control effectiveness and remediation outcomes. Drive continuous improvement in assurance coverage and risk visibility. Third Party Cyber Risk Management Own the Third-Party Cyber Risk Management framework and program. Serve as EPO Delegate for TPCRM. Oversee supplier cyber risk assessments, monitoring, remediation, and reporting. Govern critical supplier risk, concentration risk, and third-party control effectiveness. Ensure regulatory and enterprise requirements are embedded within TPCRM activities. Control Governance Own cybersecurity control governance and accountability structures. Collaborate with FLRC to ensure appropriate control ownership, visibility, evidence requirements, and testing expectations support the risk framework. Ensure alignment between controls, risks, findings, and remediation activities. Drive continual improvement and rationalization of cybersecurity controls. Issue Management Lead governance of cybersecurity issue management processes. Oversee issue intake, severity assessment, escalation, remediation tracking, validation, and closure. Monitor issue aging, systemic risk themes, and remediation effectiveness. Escalate material cyber risks through governance and executive forums. Audit Management Lead cybersecurity audit management activities. Coordinate internal audit, external audit, and regulatory audit engagements. Oversee findings governance, remediation tracking, and closure validation. Monitor systemic themes and recurring control weaknesses. ETRM / Targeted Risk Assessment Management Serve as primary cybersecurity partner to ETRM, ensuring TRA scoping well-defined and TRA outcomes are appropriately reflecting cyber risk. Coordinate technology risk assessment governance, challenge, and reporting. Ensure consistency and quality of TRAs and risk outcomes.

These skills will help you succeed in this role Financial services and highly regulated industry experience. Experience with risk quantification methodologies and cyber risk analytics. Experience leading large-scale assurance and third-party risk transformation initiatives. Expertise in NIST, FAIR, COBIT, ISO 27001, and enterprise risk management frameworks. Strong strategic leadership and executive