Chief Cybersecurity Risk Officer

Truist Bank•Charlotte, NC

22h•Onsite

About The Position

The Chief Cybersecurity Risk Officer (CCRO) is a senior executive position responsible for providing comprehensive risk oversight of the organization's cybersecurity organization. Reporting to the Chief Risk Information Officer (CIRO), this role serves as a critical second line of defense function, ensuring effective risk management across cybersecurity, while supporting the institution's strategic objectives. This role will serve as the Risk Oversight Leader for all functions within Cybersecurity. This role will lead and implement the cyber risk oversight for Truist which includes: 1) Serve as the Chief Cybersecurity Risk Officer with independent oversight and challenge to the Chief Information Security Officer (CISO) for all risk types; 2) Establish and manage cyber risk oversight – inclusive of delivery of independent assessments and continuous monitoring; 3) Provide guidance to senior leaders across the company on critical cybersecurity issues for both internal and external stakeholders; 4) Use judgment to escalate significant issues and emerging risks; communicate cyber domain maturity and residual risk to senior management including up to the Board of Directors; 5) consistently and appropriately apply second line of defense corporate authority for managing Truist’s cyber risk. Essential Duties and Responsibilities Following is a summary of the essential functions for this job. Other duties may be performed, both major and minor, which are not mentioned below. Specific activities may change from time to time. 1. Strategic Leadership - Develop and maintain the enterprise technology management framework, incorporating emerging risks related to cyber security. Establish risk appetite statements, key risk indicators, and thresholds for cyber security across the organization. Provide independent assessment and challenge of cyber security initiatives, ensuring alignment with risk appetite and regulatory expectations. Lead the evaluation of strategic cyber security decisions and their impact on the organization's risk profile. 2. Risk Leadership - Provide independent risk oversight (i.e., second line of defense/LOD2) for Truist Protection Services (TPS) through the effective identification, mitigation, monitoring and reporting of operational, technology and compliance related risks within Core Technology and Cyber. This role includes independently challenging LOD1 self-assessments and providing effective challenges of CCS to ensure applicable risk types remain within our stated risk appetite. Additionally, this role is responsible for integrating and aligning all cybersecurity risk with business unit risk, controls and assessments. Work in conjunction with other Risk Oversight Officers (RCSA, IRM, MRMD etc.) to ensure a common set of requirements in establishing a comprehensive risk management approach & transparent decision making and prioritization of technology activities. 3. Governance and Oversight - Serve as a non-voting member of the first line owned Technology, Data and Operations risk committee, a voting member of the CIRO led risk committee and actively participate in the Enterprise and Board Risk Committees (BRC) This includes (a) reviewing and effectively challenging technology and data risk policies, standards, and procedures, (b) overseeing the assessment and monitoring of critical technology vendors and third-party service providers, and (c) ensuring compliance with regulatory requirements and supervisory guidance related to cybersecurity risk. 4. Risk Assessments - Define, communicate and drive the Cyber Risk Frameworks and direct the assessment of information security and cyber risk. Provide independent assessment and oversight of the maturity of CCS and adequacy of cybersecurity controls in meeting agreed business outcomes for cybersecurity. Assessments should leverage agreed upon metrics produced by Business Units (LOD1), but challenge and validated as appropriate. 5. Risk Continuous Monitoring - Oversee the evaluation of the cybersecurity strategy and operations for potential risks and biases. Furthermore, monitor the cybersecurity project portfolios, developmental methodologies and progress on project milestones. Lead the review of significant cyber incidents and direct remediation efforts to remediate incident root causes. Using monitoring routines to identify emerging risk and/or consider accelerate risk reviews of technology policies/standards, business processes or control assessments. 6. 6 . Risk Reporting - Design the standard recurring reporting packages for Cyber Security to support ongoing reporting of identification, mitigation, monitoring of material risks. These reporting packages will be used for internal discussions and/or governance reporting. 7. Regulatory Engagement Oversight - Serve as the primary risk point of contact with regulators on cyber risk matters. This includes presenting regular risk assessments and updates to the Board and external stakeholders and collaborating with Truist Audit Services (TAS) / external auditors on cybersecurity reviews. Additionally, this role should provide effective challenge and validation procedures on all regulatory remediations where management actions are being reviewed and validated for closure. 8. Talent Management - Lead, manage and develop teammates directly and indirectly. Leverage industry insights to influence enterprise technology talent management through recommendations to Truist senior leadership to inform decisions on resource allocations (both competence and capacity). Where needed, encourage and facilitate Cybersecurity Risk education series, skills training, and industry participation in conference to elevate competence of the risk teammates and enable risk management to meet its objectives of maintaining a strong stature and influence with the company. 9. Risk Culture - Promote the culture of Risk Management across the organization by empowering risk teammates to embrace leadership direction, identify risk exposure in everyday operations and champion improving the enterprise programs for building a sustainable business model, meeting the objectives outlines by leadership and the Board of Directors.

Requirements

Bachelor’s degree in computer science, Information Systems, or data/technology related field; MBA preferred.
Fifteen+ (15+) years of progressive experience in cybersecurity relevant roles within a Category 2 or 3 Large Financial Institution (LFI) with a deep understanding of regulatory requirements for complex financial services organization (including both Federal Reserve and FDIC regulations).
In depth understanding of how data is captured, transformed, and used and the ability to connect end-to-end processes independently.
Fifteen+ (15+) years of experience or equivalent proficiency in managing people with demonstrated high competency in recruiting, developing, and coaching/mentoring.
Fifteen+ (15+) years of experience in a financial institution with emphasis on risk management or equivalent work experience.
Extensive knowledge on information security, cyber risk, core technology infrastructure, cloud operations, and technology operations.
Experience in leveraging modern tools to measure effective of technology and cyber controls.
Experience with enterprise architecture, reference architectures and emerging technologies.
Knowledge of key technology rules/regulations and technology risk management practices (e.g. Federal Financial Institutions Examination Council (FFIEC), Control Objectives for Information and Related Technology (COBIT), NIST (National Institute of Standards and Technology), Information Technology Infrastructure Library (ITIL).
Excellent leadership skills including the ability to lead direct and indirect reports, including executive level leaders.
Excellent communication (verbal and written), presentation and facilitation skills; ability to influence and communicate with impact with C-suite executives and board members.
Ability to translate technical concepts for various audiences.
Excellence in building and leading high-performing teams.

Nice To Haves

Bachelor’s degree in finance or business equivalent.
Professional designations such as Certified Information Systems Auditor (CISA), Certified in Risk and Information Systems Control (Information Systems Audit and Control Association) (CRISC), Certified Project Manager (CPM)
Strategic business and financial planning experience.
Have an innovation mindset and strong understanding of industry recognized tooling to support enterprise data programs and strong control environments.
Experience with audit processes and techniques
Exposure to and experience with adapting cybersecurity capabilities in a post Mythos threat environment.

Responsibilities

Serve as the Chief Cybersecurity Risk Officer with independent oversight and challenge to the Chief Information Security Officer (CISO) for all risk types
Establish and manage cyber risk oversight – inclusive of delivery of independent assessments and continuous monitoring
Provide guidance to senior leaders across the company on critical cybersecurity issues for both internal and external stakeholders
Use judgment to escalate significant issues and emerging risks; communicate cyber domain maturity and residual risk to senior management including up to the Board of Directors
Consistently and appropriately apply second line of defense corporate authority for managing Truist’s cyber risk
Develop and maintain the enterprise technology management framework, incorporating emerging risks related to cyber security
Establish risk appetite statements, key risk indicators, and thresholds for cyber security across the organization
Provide independent assessment and challenge of cyber security initiatives, ensuring alignment with risk appetite and regulatory expectations
Lead the evaluation of strategic cyber security decisions and their impact on the organization's risk profile
Provide independent risk oversight (i.e., second line of defense/LOD2) for Truist Protection Services (TPS) through the effective identification, mitigation, monitoring and reporting of operational, technology and compliance related risks within Core Technology and Cyber
Independently challenging LOD1 self-assessments and providing effective challenges of CCS to ensure applicable risk types remain within our stated risk appetite
Integrate and align all cybersecurity risk with business unit risk, controls and assessments
Work in conjunction with other Risk Oversight Officers (RCSA, IRM, MRMD etc.) to ensure a common set of requirements in establishing a comprehensive risk management approach & transparent decision making and prioritization of technology activities
Serve as a non-voting member of the first line owned Technology, Data and Operations risk committee, a voting member of the CIRO led risk committee and actively participate in the Enterprise and Board Risk Committees (BRC)
Review and effectively challenge technology and data risk policies, standards, and procedures
Oversee the assessment and monitoring of critical technology vendors and third-party service providers
Ensure compliance with regulatory requirements and supervisory guidance related to cybersecurity risk
Define, communicate and drive the Cyber Risk Frameworks and direct the assessment of information security and cyber risk
Provide independent assessment and oversight of the maturity of CCS and adequacy of cybersecurity controls in meeting agreed business outcomes for cybersecurity
Oversee the evaluation of the cybersecurity strategy and operations for potential risks and biases
Monitor the cybersecurity project portfolios, developmental methodologies and progress on project milestones
Lead the review of significant cyber incidents and direct remediation efforts to remediate incident root causes
Design the standard recurring reporting packages for Cyber Security to support ongoing reporting of identification, mitigation, monitoring of material risks
Serve as the primary risk point of contact with regulators on cyber risk matters
Present regular risk assessments and updates to the Board and external stakeholders
Collaborate with Truist Audit Services (TAS) / external auditors on cybersecurity reviews
Provide effective challenge and validation procedures on all regulatory remediations where management actions are being reviewed and validated for closure
Lead, manage and develop teammates directly and indirectly
Leverage industry insights to influence enterprise technology talent management through recommendations to Truist senior leadership to inform decisions on resource allocations (both competence and capacity)
Encourage and facilitate Cybersecurity Risk education series, skills training, and industry participation in conference to elevate competence of the risk teammates and enable risk management to meet its objectives of maintaining a strong stature and influence with the company
Promote the culture of Risk Management across the organization by empowering risk teammates to embrace leadership direction, identify risk exposure in everyday operations and champion improving the enterprise programs for building a sustainable business model, meeting the objectives outlines by leadership and the Board of Directors