Chief Cybersecurity Risk Officer

Truist•Greensboro, NC

3d•$300,000 - $400,000

About The Position

The Chief Cybersecurity Risk Officer (CCRO) is a senior executive responsible for comprehensive, independent risk oversight of Truist’s cybersecurity organization. Reporting to the Chief Risk Information Officer (CIRO), the role serves as a second-line-of-defense function, overseeing cyber risk management while supporting the institution’s strategic objectives. The CCRO provides independent oversight and challenge to the Chief Information Security Officer (CISO), establishes and manages cyber risk oversight through independent assessments and continuous monitoring, advises senior leaders on critical cybersecurity issues, escalates significant issues and emerging risks, and communicates cyber maturity and residual risk to senior management, including the Board of Directors. The role leads cyber risk oversight across Truist Protection Services and Cybersecurity, integrating cyber risk with business-unit risk, controls, and assessments. It develops risk frameworks, appetite statements, indicators, and thresholds; oversees technology and cybersecurity risks, vendors, regulatory compliance, assessments, reporting, and remediation; and participates in risk governance and regulatory engagement. The position also leads and develops risk teammates and promotes a strong risk-management culture.

Requirements

Bachelor’s degree in computer science, Information Systems, or a data- or technology-related field.
At least 15 years of progressive experience in cybersecurity-relevant roles within a Category 2 or 3 Large Financial Institution, with deep knowledge of regulatory requirements for complex financial services organizations, including Federal Reserve and FDIC regulations.
At least 15 years of experience, or equivalent proficiency, managing people, with demonstrated competency in recruiting, developing, and coaching or mentoring.
At least 15 years of experience in a financial institution emphasizing risk management, or equivalent work experience.
Extensive knowledge of information security, cyber risk, core technology infrastructure, cloud operations, and technology operations.
Experience using modern tools to measure the effectiveness of technology and cyber controls.
Experience with enterprise architecture, reference architectures, and emerging technologies.
Knowledge of key technology rules, regulations, and technology risk-management practices, such as FFIEC, COBIT, NIST, and ITIL.
Excellent leadership skills, including the ability to lead direct and indirect reports, including executive-level leaders.
Excellent verbal and written communication, presentation, and facilitation skills, including the ability to influence C-suite executives and board members and translate technical concepts for varied audiences.
Demonstrated excellence in building and leading high-performing teams.

Nice To Haves

MBA.
Bachelor’s degree in finance or a business-equivalent field.
Professional designations such as CISA, CRISC, or CPM.
Strategic business and financial planning experience.
An innovation mindset and strong understanding of industry-recognized tooling for enterprise data programs and strong control environments.
Experience with audit processes and techniques.
Exposure to and experience adapting cybersecurity capabilities in a post-Mythos threat environment.

Responsibilities

Develop and maintain the enterprise technology management framework, incorporating emerging cybersecurity risks.
Establish cybersecurity risk appetite statements, key risk indicators, and thresholds, and assess strategic cybersecurity decisions and initiatives against risk appetite and regulatory expectations.
Provide independent second-line risk oversight for Truist Protection Services, Core Technology, and Cyber, including identifying, mitigating, monitoring, and reporting operational, technology, and compliance risks.
Independently challenge first-line self-assessments and Cybersecurity and Technology Services (CCS) assessments, and integrate cybersecurity risk with business-unit risk, controls, and assessments.
Coordinate with other Risk Oversight Officers to establish consistent risk requirements and support transparent decision-making and prioritization of technology activities.
Participate in technology, data, operations, CIRO-led, enterprise, and Board Risk Committee governance, reviewing and challenging policies, standards, and procedures.
Oversee assessments and monitoring of critical technology vendors and third-party service providers, and ensure compliance with cybersecurity regulations and supervisory guidance.
Define, communicate, and drive cyber risk frameworks; direct information security and cyber risk assessments; and independently assess CCS maturity and cybersecurity control adequacy.
Monitor cybersecurity strategy, operations, project portfolios, development methodologies, and milestones to identify potential or emerging risks.
Lead reviews of significant cyber incidents and direct remediation of incident root causes; accelerate reviews of technology policies, standards, business processes, or control assessments when appropriate.
Design recurring cybersecurity risk reporting packages for internal discussions and governance reporting.
Serve as the primary risk contact with regulators on cyber matters; present regular assessments and updates to the Board and external stakeholders; and collaborate with Truist Audit Services and external auditors on cybersecurity reviews.
Challenge and validate regulatory remediation actions before closure.
Lead, manage, and develop direct and indirect reports; advise senior leadership on technology talent and resource allocation; and support cybersecurity risk education, skills training, and industry participation.
Promote risk-management culture and empower teammates to identify exposures and improve sustainable enterprise risk programs.

Benefits

Medical insurance
Dental insurance
Vision insurance
Life insurance
Disability insurance
Accidental death and dismemberment coverage
Tax-preferred savings accounts
401(k) plan
At least 10 days of first-year vacation, prorated as applicable
10 sick days, prorated as applicable
Paid holidays
Depending on position and division, possible eligibility for a defined benefit pension plan, restricted stock units, and/or deferred compensation plan