Cyber Resilience Associate

SMBC•Charlotte, NC

1d•Hybrid

About The Position

The Cyber Resilience Associate works within the Cyber Resilience team in the SMBC Americas Division Information Security Office and reports to the VP, Cyber Resilience. The role supports identifying, assessing, and communicating cyber, technology, and operational resilience risks associated with emerging technologies, including artificial intelligence, automation, cloud services, third-party platforms, and evolving threat modeling capabilities. The Associate supports day-to-day threat modeling, emerging technology risk analysis, control mapping, issue documentation, and stakeholder reporting. The role evaluates how new technologies affect threat scenarios, dependencies, attack surfaces, misuse cases, and resilience across important business services, applications, infrastructure, vendors, and technology processes. The successful candidate is analytical, detail-oriented, able to learn technical domains quickly, and able to communicate risk observations clearly to technical and non-technical audiences.

Requirements

At least 2 years of experience in cybersecurity, technology risk, information security, operational resilience, audit, application security, architecture, threat intelligence, or a related technology control function.
Foundational understanding of cybersecurity risk concepts, including threats, vulnerabilities, controls, attack surfaces, compensating controls, and residual risk.
Working knowledge of threat modeling concepts, secure design principles, SDLC practices, cloud services, APIs, identity and access management, and enterprise technology environments.
Familiarity with emerging technology risk areas, including AI/LLM systems, automation, data protection, third-party technology platforms, and cloud-based services.
Ability to analyze technical information, identify risk-relevant patterns, and document findings clearly, structurally, and based on evidence.
Strong written communication skills, including the ability to summarize technical risks for non-technical stakeholders.
Strong organizational skills and ability to manage multiple assignments, track open items, and maintain accurate documentation.
Ability to work effectively in a matrixed environment with technology, cybersecurity, risk, compliance, business, and vendor stakeholders.
Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Information Technology, Engineering, Business, Risk Management, or equivalent relevant experience.

Nice To Haves

Familiarity with frameworks and references such as NIST CSF, NIST SP 800-53, ISO 27001/27002, OWASP Top 10, OWASP LLM Top 10, MITRE ATT&CK, MITRE ATLAS, or similar control and threat frameworks.
Experience with risk assessment tools, GRC platforms, vulnerability management tools, architecture repositories, diagramming tools, or threat modeling platforms.
Basic scripting, data analysis, reporting, or workflow automation experience.
Financial services, regulated industry, consulting, or enterprise technology experience.
Relevant certifications or training, such as Security+, CySA+, GSEC, GCIH, SSCP, CISA, CRISC, CCSK, cloud fundamentals certifications, or AI/security-focused training.

Responsibilities

Support threat modeling and emerging technology risk assessments across applications, platforms, business services, and third-party technology solutions.
Analyze emerging technology use cases, including AI and LLM-enabled capabilities, automation, cloud services, APIs, data integrations, and security tooling, to identify relevant threat scenarios and risk themes.
Document assets, data flows, trust boundaries, dependencies, threat agents, attack paths, control coverage, and residual risks.
Support risk analysis of AI and LLM scenarios, including prompt injection, data leakage, model misuse, excessive agency, insecure integrations and outputs, and third-party dependency risks.
Maintain threat modeling evidence, assessment workpapers, issue documentation, and reporting artifacts in approved repositories and tools.
Partner with application, architecture, infrastructure, information security, technology risk, and business stakeholders to gather assessment information and validate findings.
Map identified risks and controls to relevant frameworks, standards, and internal control taxonomies, including NIST, ISO, OWASP, MITRE, and internal cyber resilience and control frameworks.
Prepare concise reports, summaries, dashboards, and briefing materials communicating assessment scope, key risks, control observations, open questions, and recommended next actions.
Track action items, enhancement opportunities, and remediation activities identified through threat modeling or emerging technology risk reviews.
Monitor emerging cybersecurity and technology risk trends, including AI security, adversarial use of automation, cloud security, API abuse, supply chain risk, and sector-relevant threat activity.
Help improve templates, playbooks, taxonomies, questionnaires, and repeatable assessment procedures.
Contribute to cross-functional discussions about secure adoption of emerging technologies, operational resilience, and risk-informed technology decisions.
Maintain awareness of the firm's important business services, critical systems, technology dependencies, and third-party relationships to support resilience-focused analysis.
Perform multiple concurrent assignments while maintaining accuracy, traceability, and clear documentation.