Cyber Controls Manager, VP

Sumitomo Mitsui Banking Corporation•New York, NY

26d•Hybrid

About The Position

Join SMBC’s Cyber Governance team as Vice President, Cyber Controls Manager. You will lead the Cyber Controls & Regulatory Frameworks function and strengthen how we design, govern, measure, and maintain cybersecurity controls. You will combine hands-on controls expertise with team leadership to simplify a mature program, improve regulatory alignment, and expand continuous controls monitoring. This role reports to the Head of Cyber Governance and manages one direct report, along with contractors and matrixed resources.

Requirements

6+ years of relevant experience in cybersecurity governance, technology or cyber audit, technology risk, controls assurance, first-line controls, operational risk, or a related discipline. Experience must include financial services or another highly regulated environment.
Experience designing, assessing, challenging, mapping, rationalizing, or governing cybersecurity or technology controls.
Working knowledge of the NIST Cybersecurity Framework, CRI Profile, NYDFS Part 500, FFIEC guidance, and relevant Federal Reserve or U.S. banking expectations for cybersecurity and technology risk.
Understanding of key domains such as identity and access management, vulnerability and patch management, logging and monitoring, endpoint and network security, cloud security, data protection, secure development, third-party risk, incident response, and resilience.
Experience working with Internal Audit, Risk, Compliance, senior leaders, and control owners, including reviewing control design, evidence, gaps, and conclusions.
Experience leading programs or teams, setting priorities, reviewing detailed work, and delivering complex controls or governance initiatives.
Strong analytical, written, verbal, facilitation, and presentation skills, including the ability to translate technical and regulatory requirements into clear actions and executive-level reporting.
Bachelor’s degree or equivalent relevant professional experience.

Nice To Haves

7+ years of relevant experience, including responsibility for a significant cyber controls, technology risk, audit, regulatory, or governance program.
Experience in both cyber or technology audit and a first-line risk, controls, or governance function.
Experience with continuous controls monitoring, including KCIs, control-health metrics, RAG thresholds, monitoring logic, or executive dashboards.
Knowledge of ISO/IEC 27001, NIST SP 800-53, or international cyber and operational-resilience requirements such as OSFI B-13, DORA, EBA guidance, ECB expectations, or CIMA requirements.
Experience with an enterprise GRC platform such as SAI360, ServiceNow, Archer, or a comparable platform, and/or a relevant certification such as CISA, CISSP, CISM, or CRISC.

Responsibilities

Own the Cyber Controls Library, including control objectives, descriptions, ownership, applicability, taxonomy, versioning, change governance, rationalization, and retirement.
Maintain traceable mappings across cyber controls, the NIST Cybersecurity Framework, CRI Profile, regulatory requirements, and internal policies and standards.
Identify coverage gaps and prepare the program for regulatory reviews.
Lead key-control analysis and rationalization.
Apply risk-based criteria to key-control designations and identify opportunities to remove duplication, simplify controls, and strengthen coverage.
Guide continuous controls monitoring.
Define and challenge key control indicators, data requirements, measurement methods, RAG thresholds, escalation criteria, and reporting with Cyber Data, Governance Engineering & Automation, and control owners.
Design and improve controls that address cyber risks, regulatory requirements, policy obligations, audit findings, and identified gaps.
Conduct targeted quality reviews and assess documentation, evidence, and traceability.
Develop metrics, dashboards, and executive reporting that clearly communicate control health, trends, risk concentrations, data limitations, and decisions requiring leadership attention.
Partner with Cyber, Technology, Internal Audit, Risk, Compliance, Operational Resilience, and control owners on inquiries, control challenges, issue interpretation, and sustainable corrective actions.
Lead one direct report and coordinate contractors or matrixed resources.
Set priorities, review deliverables, clarify accountability, and improve governance processes through standardization and automation.