Cyber Business Risk Officer

SMBC•Charlotte, NC

11d•Hybrid

About The Position

The Cyber Business Risk Officer (CBRO) serves as the strategic risk partner between Cybersecurity and assigned business and technology organizations. The role provides an integrated view of cybersecurity risk, remediation, governance, and business impact, translating cyber risk into actionable business priorities and driving transparency and accountability for risk reduction. In partnership with Cyber GRC, the CBRO helps business lines, group companies, and technology teams prioritize impactful cyber risk-reduction activities and enables informed leadership decisions through risk insight, business context, metrics, governance, and execution. The CBRO partners with senior Cyber, Technology, Risk, and business leaders; oversees significant cyber risks and remediation; establishes governance and executive reporting; and develops metrics and analytics to communicate exposure, trends, remediation progress, and outcomes. The role also assesses cyber implications of business and technology transformations, investments, operating-model changes, and emerging risks. SMBC uses a hybrid workforce model, with employees working from home and an SMBC office, and requires employees to live within reasonable commuting distance of their office location. Candidates will learn about the specific hybrid schedule during the interview process; hybrid work may not be available for some roles.

Requirements

Significant experience in cybersecurity, technology risk, operational risk, information security, technology governance, or related disciplines.
Demonstrated ability to operate with senior Cyber, Technology, Risk, and business executives.
Strong understanding of cybersecurity risk management, controls, governance, and remediation.
Experience developing executive-level risk reporting, governance forums, metrics, and management insights.
Ability to translate complex cybersecurity issues into concise business implications and decision points.
Strong analytical, communication, stakeholder-management, and executive-influencing capabilities.
Demonstrated experience leading across organizational boundaries without relying solely on direct authority.

Nice To Haves

Experience within a complex, highly regulated, global organization.
Familiarity with established cybersecurity and risk frameworks such as NIST Cybersecurity Framework, ISO 27001, COBIT, or equivalent.
Experience with regulatory examinations, internal audit, control assessments, technology transformation, or enterprise risk management.
Relevant professional certifications such as CISSP, CISM, CRISC, or comparable risk/security credentials.

Responsibilities

Serve as the senior cybersecurity risk partner to assigned CIO and business organizations.
Develop a holistic view of cybersecurity risk, connecting technical findings with business impact and strategic priorities.
Identify material and emerging cyber risks and ensure appropriate visibility, escalation, ownership, and governance.
Facilitate risk-based prioritization of cybersecurity investments and remediation activities.
Promote consistent cybersecurity risk-management practices across organizational boundaries.
Establish and lead governance forums that provide leadership visibility into cybersecurity risk, remediation, and strategic priorities.
Develop executive-level cyber risk reporting covering exposure, trends, remediation progress, decisions, and matters requiring leadership attention.
Provide actionable insights to leadership and establish accountability for cybersecurity risks, decisions, and remediation outcomes.
Support executive, committee, regulatory, and other governance reporting as required.
Maintain visibility of significant cyber risks, control gaps, findings, exceptions, and remediation commitments.
Challenge remediation strategies, priorities, target dates, and risk disposition where appropriate.
Monitor remediation performance and identify systemic issues, dependencies, and barriers affecting risk reduction.
Escalate material risks and remediation concerns through appropriate governance channels.
Measure and communicate remediation outcomes and demonstrated risk reduction.
Act as a trusted advisor to CIO, Cyber, Risk, and business leadership.
Translate technical cybersecurity issues into clear business risks and decision points.
Establish regular Cyber Business Risk touchpoints with technology and business organizations.
Connect cybersecurity strategy and requirements with technology transformation, business priorities, and operational realities.
Foster collaboration across Cyber, Technology, Enterprise Risk, Internal Audit, and other control functions while maintaining appropriate ownership boundaries.
Develop meaningful metrics, KRIs, dashboards, and executive reporting that provide transparency into cybersecurity posture.
Identify trends, concentrations of risk, recurring control issues, and areas requiring leadership intervention.
Establish mechanisms to measure the effectiveness and outcomes of cyber risk-reduction initiatives.
Drive consistency and quality in cyber risk data used for leadership decisions.
Use metrics and analytics to shift cyber risk discussions from activity and issue counts to exposure, accountability, and outcomes.
Assess cybersecurity implications of significant technology and business transformation initiatives.
Provide risk insight for strategic decisions, investments, operating-model changes, and major programs.
Identify emerging risks arising from technology changes, the threat landscape, business strategy, third parties, and operating environments.
Help ensure cyber transformation initiatives translate into sustainable improvements in risk posture.