Cyber Security & Third Party Due Diligence Associate Director

DTCC • Tampa, FL

7d • Hybrid

About The Position

The Cyber Security & Third Party Due Diligence Associate Director leads the Cyber Security Due Diligence SME team within DTCC’s Cyber Security Risk Office. The role oversees technology, cybersecurity, and operational resilience risk assessments across DTCC’s third-party ecosystem, helping identify, assess, monitor, and remediate risks associated with vendors, service providers, and other external partners.

This position works with Business, Technology, Legal, Sourcing, Resilience, and Risk Management stakeholders on due diligence assessments, third-party onboarding, control-gap remediation, onsite reviews, and specialized assessments. Areas of focus include fourth-party risk, NYSDFS cybersecurity reviews, encryption key management, and software supply chain security. The role also advances third-party cyber risk reviews and assessment methodologies, supports regulatory compliance, and develops a high-performing team of cyber risk professionals.

Requirements

• At least 8 years of related experience in cybersecurity, cyber operations, cyber risk, IT audit, or technology risk.
• Knowledge of frameworks and regulations, including the Cyber Risk Institute (CRI) and NIST Cybersecurity Framework.

Nice To Haves

• Bachelor’s degree or equivalent experience; a bachelor’s degree is preferred.
• Professional certifications such as CISSP, CISA, CRISC, or equivalent are a plus.

Responsibilities

• Lead and develop a team of Cyber Security Due Diligence SMEs conducting technology, cybersecurity, operational resilience, and specialized risk assessments of third parties supporting DTCC’s critical services.
• Oversee third-party technology and resilience due diligence to ensure assessments follow DTCC policies, regulatory expectations, and established service-level agreements.
• Act as the primary escalation point for complex cybersecurity, technology, resilience, and remediation risks identified during third-party assessments and onboarding.
• Provide subject matter expertise on third-party cyber risk management, emerging regulatory requirements, and industry practices, including NYSDFS Cybersecurity Regulation, operational resilience, software supply chain risk, fourth-party risk, and encryption key management.
• Direct technology risk assessments, operational resilience reviews, onsite assessments, and specialized reviews for critical third parties; ensure identified risks are assessed, documented, and mitigated.
• Partner with Sourcing, Legal, Enterprise Program Management, the Architecture Review Board, Technology, Resilience, Security, and Business stakeholders on third-party onboarding, contract reviews, and risk-based decisions.
• Drive remediation of identified third-party control gaps and assessment findings, ensuring accountability, transparency, and timely risk reduction.
• Develop and present management reporting, key risk indicators, and executive updates on third-party cyber risk, emerging trends, remediation status, and program effectiveness.
• Build and maintain relationships with internal stakeholders, regulators, auditors, and external third parties; represent the Cyber Security Risk Office on strategic third-party cyber risk initiatives.
• Ensure third-party cyber risk management supports DTCC’s risk management framework, regulatory compliance, control environment, and operational resilience.

Benefits

• Competitive compensation, including base pay and annual incentive.
• Comprehensive health and life insurance and well-being benefits, based on location.
• Pension or retirement benefits.
• Paid time off and personal/family care, and other leaves of absence.

What This Job Offers

• Job Type: Full-time
• Career Level: Director
• Education Level: No Education Listed