Cyber Resilience Associate

Sumitomo Mitsui Banking Corporation • Charlotte, NC

2d • Hybrid

About The Position

The Cyber Resilience Associate reports to the VP, Cyber Resilience and is part of the Cyber Resilience team in the SMBC Americas Division Information Security Office. The role supports identification, assessment, and communication of cyber, technology, and operational resilience risks associated with emerging technologies, including artificial intelligence, automation, cloud services, third-party platforms, and evolving threat modeling capabilities.

The Associate supports threat modeling, emerging technology risk analysis, control mapping, issue documentation, and stakeholder reporting. The role evaluates how new technologies affect threat scenarios, dependencies, attack surfaces, misuse cases, and resilience considerations across important business services, applications, infrastructure, vendors, and technology processes. The position involves collaboration across cybersecurity, technology risk, architecture, and business stakeholders, and requires clear documentation and communication of technical concepts in practical risk terms.

Requirements

• At least 2 years of experience in cybersecurity, technology risk, information security, operational resilience, audit, application security, architecture, threat intelligence, or a related technology control function.
• Foundational understanding of cybersecurity risk concepts, including threats, vulnerabilities, controls, attack surfaces, compensating controls, and residual risk.
• Working knowledge of threat modeling concepts, secure design principles, SDLC practices, cloud services, APIs, identity and access management, and enterprise technology environments.
• Familiarity with emerging technology risk areas, including AI/LLM systems, automation, data protection, third-party technology platforms, and cloud-based services.
• Ability to analyze technical information, identify risk-relevant patterns, and document findings clearly, structurally, and with evidence.
• Strong written communication skills, including the ability to summarize technical risks for non-technical stakeholders.
• Strong organizational skills and ability to manage multiple assignments, track open items, and maintain accurate documentation.
• Ability to work effectively in a matrixed environment with technology, cybersecurity, risk, compliance, business, and vendor stakeholders.
• BA/BS in Cybersecurity, Computer Science, Information Systems, Information Technology, Engineering, Business, or Risk Management, or equivalent relevant experience.

Nice To Haves

• Familiarity with frameworks and references such as NIST CSF, NIST SP 800-53, ISO 27001/27002, OWASP Top 10, OWASP LLM Top 10, MITRE ATT&CK, MITRE ATLAS, or similar control/threat frameworks.
• Experience with risk assessment tools, GRC platforms, vulnerability management tools, architecture repositories, diagramming tools, or threat modeling platforms.
• Basic scripting, data analysis, reporting, or workflow automation experience.
• Financial services, regulated industry, consulting, or enterprise technology experience.
• Relevant certifications, such as Security+, CySA+, GSEC, GCIH, SSCP, CISA, CRISC, CCSK, cloud fundamentals certifications, or AI/security-focused training.

Responsibilities

• Support threat modeling and emerging technology risk assessments across applications, platforms, business services, and third-party technology solutions.
• Analyze emerging technology use cases, including AI/LLM-enabled capabilities, automation, cloud services, APIs, data integrations, and security tooling, to identify threat scenarios and risk themes.
• Document assets, data flows, trust boundaries, dependencies, threat agents, attack paths, control coverage, and residual risks.
• Support risk analysis for AI and LLM scenarios, including prompt injection, data leakage, model misuse, excessive agency, insecure integrations and outputs, and third-party dependency risks.
• Maintain threat modeling evidence, assessment workpapers, issue documentation, and reporting artifacts in approved repositories and tools.
• Partner with application, architecture, infrastructure, information security, technology risk, and business stakeholders to collect assessment information and validate findings.
• Map identified risks and controls to relevant frameworks, standards, and internal control taxonomies, including NIST, ISO, OWASP, MITRE, and internal cyber resilience/control frameworks.
• Prepare concise reports, summaries, dashboards, and briefing materials on assessment scope, key risks, control observations, open questions, and recommended next actions.
• Track action items, enhancement opportunities, and issue remediation activities identified through reviews.
• Monitor cybersecurity and technology risk trends, including AI security, adversarial use of automation, cloud security, API abuse, supply chain risk, and sector-relevant threat activity.
• Help improve templates, playbooks, taxonomies, questionnaires, and repeatable assessment procedures.
• Contribute to cross-functional discussions about secure adoption of emerging technologies, operational resilience, and risk-informed technology decisions.
• Maintain awareness of important business services, critical systems, technology dependencies, and third-party relationships to support resilience-focused analysis.
• Perform multiple concurrent assignments while maintaining accuracy, traceability, and clear documentation.

Benefits

• Hybrid workforce model with the opportunity to work from home and from an SMBC office.
• Reasonable accommodations during candidacy for applicants with disabilities, consistent with applicable law.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level