Cyber Security Analyst - Vice President

Sumitomo Mitsui Banking Corporation•Charlotte, NC

3d•Hybrid

About The Position

The Cyber Security Analyst - Vice President reports to the VP Cyber Resilience and is part of the Cyber Resilience team within the SMBC Americas Division Information Security Office. The team supports 14 companies in managing Cyber Resilience activities in accordance with applicable regulations, firm policies, and industry best practices for Information Security and Operational Resilience. The role executes and matures an enterprise Threat Modeling Assessment program. It builds visual threat models of enterprise services that represent assets, controls, threat agents, trust zones, attack paths, and potential attacks, and produces related reporting and issue-management documents. The position also contributes to information technology, data management, cybersecurity, and operational resilience management across businesses, including regional resilience coordination and progress reporting to executive leadership. The position champions Cyber Resilience concerns, controls, and program maturity at the firm, particularly for modeled environments and related processes such as Architecture and the Software Development Lifecycle. It develops knowledge of critical services and their technology, people, process, and third-party dependencies; identifies cyber risks and dependencies; and supports mitigation and enhancement activities.

Requirements

Deep understanding of enterprise architecture and security architectural elements as they relate to risks and controls, including the ability to accurately capture and enhance architectural diagrams.
Knowledge of Cyber Resilience, including technology, incident response, and cyber risk practices, and the ability to align them with firm processes and frameworks.
At least 8 years of direct work experience in the financial services industry, focused on security architecture as it relates to cyber threats.
Working knowledge of business and cyber risk management processes and controls, industry practices, and frameworks such as NIST 800-53 and the ISO 27000 family.
Broad knowledge of cloud technologies.
Detail orientation and the ability to question the status quo and apply resilience activities to enhance capabilities.
Strong organizational skills and the ability to manage multiple concurrent priorities and team members as the program is built out.
Ability to communicate and work effectively in a matrixed environment and across organizational levels, with flexibility, collaboration, and adaptability.
Strong analytical skills and attention to detail.
Ability to communicate technical issues to a non-technical executive audience.
Foundational knowledge of banking laws and regulations, including FFIEC, BCBS, FCA, PRA, and BoE.
Business cyber threat mindset to understand underlying risks and weaknesses and support mitigation and enhancement activities.
Commitment to delivering quality, meaningful work products in a timely and efficient manner.
BA/BS in Computer Engineering, Computer Science, Information Systems, Cyber Security, or Business Administration, or demonstrated relevant industry background and/or military experience.

Nice To Haves

AWS or Azure certification.
CCSP Certified Cloud Security Professional (CCSP), Microsoft Certified: Cybersecurity Architect Expert (MS SC-100 Exam), Certified Network Defense Architect (CNDA), CREST Registered Technical Security Architect (CRTSA), or Global Information Assurance Certifications Defensible Security Architect (GDSA from GIAC).

Responsibilities

Facilitate management of an enterprise Threat Modeling Assessment program and enhance its maturity across the firm.
Build threat models of enterprise services to identify and refine the attack surface.
Champion the Threat Modeling Assessment program and contribute to its maturation.
Deliver reports documenting identified risks, controls, assets, trust zones, and enhancement requirements.
Partner with stakeholders on Threat Modeling Assessment issues and develop action plans for issues identified during fieldwork.
Prioritize engagements using a risk-based approach.
Assess alignment between Cyber Resilience controls in practice and authoritative sources such as NIST SP 800-53 and ISO 27002, identifying current capabilities, risk themes, and best practices.
Develop knowledge of critical services and their dependencies on technology, people, processes, and third parties.
Assess the impact of cyber risks on the firm and industry, including technical and security dependencies and single points of failure, to enhance mitigation activities.
Educate and provide subject matter expertise to the business on cyber hygiene and enhancements based on business-related impacts.
Participate in information technology, data management, cybersecurity, and operational resilience management across businesses.
Coordinate regional resilience activities and report progress to executive leadership.