Cyber Business Risk Officer

Sumitomo Mitsui Banking Corporation•Charlotte, NC

12d•Hybrid

About The Position

The Cyber Business Risk Officer (CBRO) serves as the strategic risk partner between Cybersecurity and assigned business and technology organizations. The role provides an integrated view of cybersecurity risk, remediation, governance, and business impact, and translates cyber risk into actionable business priorities. The CBRO establishes effective governance and reporting, drives transparency and accountability for risk reduction, and partners with Cyber GRC to help business lines, group companies, and technology teams prioritize impactful cyber risk reduction activities. The position brings together risk insight, business context, metrics, governance, and execution to enable informed leadership decisions and demonstrate measurable risk reduction. It serves as a senior cybersecurity risk partner to assigned CIO and business organizations, advising leadership, overseeing significant risks and remediation, and supporting strategic business and technology decisions. SMBC uses a hybrid workforce model that provides employees an opportunity to work from home and from an SMBC office. Employees must live within a reasonable commuting distance of their office location. Candidates will learn more about the specific hybrid schedule during the interview process; hybrid work may not be permitted for certain roles.

Requirements

Significant experience in cybersecurity, technology risk, operational risk, information security, technology governance, or related disciplines.
Demonstrated ability to operate with senior Cyber, Technology, Risk, and business executives.
Strong understanding of cybersecurity risk management, controls, governance, and remediation.
Experience developing executive-level risk reporting, governance forums, metrics, and management insights.
Ability to translate complex cybersecurity issues into concise business implications and decision points.
Strong analytical, communication, stakeholder-management, and executive-influencing capabilities.
Demonstrated experience leading across organizational boundaries without relying solely on direct authority.

Nice To Haves

Experience within a complex, highly regulated, global organization.
Familiarity with cybersecurity and risk frameworks such as NIST Cybersecurity Framework, ISO 27001, COBIT, or equivalent.
Experience with regulatory examinations, internal audit, control assessments, technology transformation, or enterprise risk management.
Relevant professional certifications such as CISSP, CISM, CRISC, or comparable risk/security credentials.

Responsibilities

Serve as the senior cybersecurity risk partner to assigned CIO and business organizations.
Develop a holistic view of cybersecurity risk, connecting technical findings with business impact and strategic priorities.
Identify material and emerging cyber risks and ensure appropriate visibility, escalation, ownership, and governance.
Facilitate risk-based prioritization of cybersecurity investments and remediation activities.
Promote consistent cybersecurity risk-management practices across organizational boundaries.
Establish and lead governance forums that provide leadership visibility into cybersecurity risk, remediation, and strategic priorities.
Develop executive-level cyber risk reporting on exposure, trends, remediation progress, decisions, and issues requiring leadership attention.
Provide actionable insights rather than activity-based reporting, and establish accountability for cybersecurity risks, decisions, and remediation outcomes.
Support executive, committee, regulatory, and other governance reporting as required.
Maintain visibility of significant cyber risks, control gaps, findings, exceptions, and remediation commitments.
Challenge remediation strategies, priorities, target dates, and risk dispositions where appropriate.
Monitor remediation performance and identify systemic issues, dependencies, and barriers affecting risk reduction.
Escalate material risks and remediation concerns through appropriate governance channels.
Measure and communicate remediation outcomes and demonstrated risk reduction.
Act as a trusted advisor to CIO, Cyber, Risk, and business leadership.
Translate technical cybersecurity issues into clear business risks and decision points.
Establish regular Cyber Business Risk touchpoints with technology and business organizations.
Connect cybersecurity strategy and requirements with technology transformation, business priorities, and operational realities.
Foster collaboration across Cyber, Technology, Enterprise Risk, Internal Audit, and other control functions while maintaining appropriate ownership boundaries.
Develop meaningful metrics, KRIs, dashboards, and executive reporting that provide transparency into cybersecurity posture.
Identify trends, risk concentrations, recurring control issues, and areas requiring leadership intervention.
Establish mechanisms to measure the effectiveness and outcomes of cyber risk-reduction initiatives.
Drive consistency and quality in cyber risk data used for leadership decisions.
Use metrics and analytics to shift cyber risk discussions from activity and issue counts to exposure, accountability, and outcomes.
Assess cybersecurity implications of significant technology and business transformation initiatives.
Provide risk insight for strategic decisions, investments, operating-model changes, and major programs.
Identify emerging risks arising from technology, the threat landscape, business strategy, third parties, and operating environments.
Help ensure cyber transformation initiatives translate into sustainable improvements in risk posture.