Cyber Security Analyst - Vice President

SMBC • Charlotte, NC

1d • Hybrid

About The Position

The Cyber Security Analyst – Vice President role is part of the Cyber Resilience (COR) team within the SMBC Americas Division Information Security Office and reports to the VP Cyber Resilience. COR supports 14 companies in managing cyber resilience activities in accordance with applicable regulations, firm policies, and information security and operational resilience best practices.

The role executes and matures an enterprise Threat Modeling Assessment program. It creates visual representations of assets, controls, threat agents, trust zones, attack paths, and potential attacks, along with related reporting and issue management. The position also participates in technology, data management, cybersecurity, and operational resilience management across businesses, including regional resilience coordination and reporting progress to executive leadership. It champions cyber resilience concerns, controls, and maturation at the firm, particularly for modeled environments and related processes such as architecture and the software development lifecycle.

SMBC employees participate in a hybrid workforce model, working both from home and an SMBC office. Employees must live within a reasonable commuting distance of their office location. Candidates will learn about the specific hybrid schedule during the interview process; hybrid work may not be permitted for certain roles.

Requirements

• At least 8 years of direct work experience in the financial services industry, focused on security architecture as it relates to cyber threats.
• Deep understanding of enterprise architecture and security architectural elements as they relate to risks and controls; ability to accurately capture and enhance architectural diagrams.
• Well-versed in Cyber Resilience, including technology, incident response, and cyber risk practices, and able to align these with firm processes and frameworks.
• Working knowledge of business and cyber risk management processes, controls, industry practices, and frameworks such as NIST 800-53 and the ISO 27000 family.
• Broad knowledge of cloud technologies.
• Detail-oriented, with the ability to question the status quo and apply resilience activities to enhance capabilities as appropriate.
• Strong organizational skills and demonstrated ability to manage multiple concurrent priorities and team members as the program is built out.
• Ability to communicate and work effectively in a matrixed environment and across organizational levels, with flexibility, collaboration, and adaptability.
• Strong analytical skills and attention to detail.
• Ability to communicate technical issues to a non-technical executive audience.
• Foundational knowledge of banking laws and regulations, such as FFIEC, BCBS, FCA, PRA, and BoE.
• Maintain a business cyber threat mindset to understand underlying risks and weaknesses and assist with mitigation and enhancement activities.
• Commitment to delivering quality, meaningful work products in a timely and efficient manner.
• BA/BS in Computer Engineering, Computer Science, Information Systems, Cyber Security, or Business Administration, or demonstrated relevant industry background and/or military experience.

Nice To Haves

• AWS or Azure certification is a plus.
• Preferred certifications include CCSP (Certified Cloud Security Professional), Microsoft Certified: Cybersecurity Architect Expert (MS SC-100 Exam), Certified Network Defense Architect (CNDA), CREST Registered Technical Security Architect (CRTSA), or Global Information Assurance Certifications Defensible Security Architect (GDSA from GIAC).

Responsibilities

• Facilitate management of an enterprise Threat Modeling Assessment program and enhance its maturity across the firm.
• Build threat models of enterprise services to identify and refine the attack surface.
• Champion the Threat Modeling Assessment program and play a pivotal role in its maturation.
• Deliver reports capturing identified risks, controls, assets, trust zones, and enhancement requirements.
• Partner with stakeholders on Threat Modeling Assessment issues and create action plans for issues identified during fieldwork.
• Prioritize engagements using a risk-based approach.
• Assess alignment between Cyber Resilience controls in practice and authoritative sources such as NIST SP 800-53 and ISO 27002, providing insight into capabilities, risk themes, and best practices.
• Develop deep knowledge of SMBC critical services and their dependencies on technology, people, processes, and third parties.
• Understand the effects of cyber risks on the firm and industry, including impacts to technical and security dependencies and single points of failure, to enhance mitigation activities.
• Educate and provide subject matter expertise to support business cyber hygiene activities and enhancements based on business impacts.
• Participate in information technology, data management, cybersecurity, and operational resilience management across businesses.
• Coordinate regional resilience activities and report progress to executive leadership.
• Champion Cyber Resilience concerns, controls, and maturation at the firm, particularly for modeled environments and related Architecture and SDLC processes.

Benefits

• Hybrid workforce model with the opportunity to work from home and from an SMBC office.
• Reasonable accommodations during candidacy for applicants with disabilities, consistent with applicable law.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior