Cyber Controls Manager, VP

Sumitomo Mitsui Banking Corporation•Charlotte, NC

27d•Hybrid

About The Position

SMBC is seeking a Vice President, Cyber Controls Manager to lead its Cyber Controls & Regulatory Frameworks function within the Cyber Governance team. The role strengthens the design, governance, measurement, and maintenance of cybersecurity controls by simplifying a mature program, improving regulatory alignment, and expanding continuous controls monitoring. The position owns the Cyber Controls Library and maintains traceable mappings between cyber controls, the NIST Cybersecurity Framework, CRI Profile, regulatory requirements, and internal policies and standards. It leads key-control analysis and rationalization, guides continuous controls monitoring, designs and improves controls, conducts targeted quality reviews, and develops metrics, dashboards, and executive reporting. The Cyber Controls Manager partners with Cyber, Technology, Internal Audit, Risk, Compliance, Operational Resilience, and control owners. The role reports to the Head of Cyber Governance and manages one direct report, as well as contractors and matrixed resources. SMBC uses a hybrid workforce model, with employees working from home and an SMBC office; employees must live within a reasonable commuting distance of their office. Specific hybrid schedules are discussed during the interview process.

Requirements

At least 6 years of relevant experience in cybersecurity governance, technology or cyber audit, technology risk, controls assurance, first-line controls, operational risk, or a related discipline, including experience in financial services or another highly regulated environment.
Experience designing, assessing, challenging, mapping, rationalizing, or governing cybersecurity or technology controls.
Working knowledge of the NIST Cybersecurity Framework, CRI Profile, NYDFS Part 500, FFIEC guidance, and relevant Federal Reserve or U.S. banking expectations for cybersecurity and technology risk.
Understanding of cybersecurity domains including identity and access management, vulnerability and patch management, logging and monitoring, endpoint and network security, cloud security, data protection, secure development, third-party risk, incident response, and resilience.
Experience working with Internal Audit, Risk, Compliance, senior leaders, and control owners, including reviewing control design, evidence, gaps, and conclusions.
Experience leading programs or teams, setting priorities, reviewing detailed work, and delivering complex controls or governance initiatives.
Strong analytical, written, verbal, facilitation, and presentation skills, including the ability to translate technical and regulatory requirements into clear actions and executive-level reporting.
Bachelor’s degree or equivalent relevant professional experience.

Nice To Haves

At least 7 years of relevant experience, including responsibility for a significant cyber controls, technology risk, audit, regulatory, or governance program.
Experience in both cyber or technology audit and a first-line risk, controls, or governance function.
Experience with continuous controls monitoring, including KCIs, control-health metrics, RAG thresholds, monitoring logic, or executive dashboards.
Knowledge of ISO/IEC 27001, NIST SP 800-53, or international cyber and operational-resilience requirements such as OSFI B-13, DORA, EBA guidance, ECB expectations, or CIMA requirements.
Experience with an enterprise GRC platform such as SAI360, ServiceNow, Archer, or a comparable platform.
A relevant certification such as CISA, CISSP, CISM, or CRISC.

Responsibilities

Own the Cyber Controls Library, including control objectives, descriptions, ownership, applicability, taxonomy, versioning, change governance, rationalization, and retirement.
Maintain traceable mappings across cyber controls, the NIST Cybersecurity Framework, CRI Profile, regulatory requirements, and internal policies and standards.
Identify coverage gaps and prepare the program for regulatory reviews.
Lead key-control analysis and rationalization, applying risk-based criteria to designations and identifying opportunities to remove duplication, simplify controls, and strengthen coverage.
Guide continuous controls monitoring by defining and challenging key control indicators, data requirements, measurement methods, RAG thresholds, escalation criteria, and reporting in collaboration with Cyber Data, Governance Engineering & Automation, and control owners.
Design and improve controls addressing cyber risks, regulatory requirements, policy obligations, audit findings, and identified gaps.
Conduct targeted quality reviews and assess documentation, evidence, and traceability.
Develop metrics, dashboards, and executive reporting that communicate control health, trends, risk concentrations, data limitations, and decisions requiring leadership attention.
Partner with Cyber, Technology, Internal Audit, Risk, Compliance, Operational Resilience, and control owners on inquiries, control challenges, issue interpretation, and sustainable corrective actions.
Lead one direct report and coordinate contractors or matrixed resources.
Set priorities, review deliverables, clarify accountability, and improve governance processes through standardization and automation.