Cyber Security & Third Party Due Diligence Associate Director

DTCC • Tampa, FL

8d • $95,000 - $180,000 • Hybrid

About The Position

The Associate Director will lead the Cyber Security Due Diligence subject matter expert team within DTCC's Cyber Security Risk Office. The team oversees technology, cybersecurity, and operational resilience risk assessments across DTCC's third-party ecosystem. The role supports the Third Party Risk Management program by identifying, assessing, monitoring, and remediating cyber and technology risks associated with vendors, service providers, and other external partners.

The role works with Business, Technology, Legal, Sourcing, Resilience, and Risk Management stakeholders on due diligence assessments, third-party onboarding, control-gap remediation, onsite reviews, and specialized assessments. These include fourth-party risk, NYSDFS cybersecurity reviews, encryption key management, and software supply chain security. The Associate Director also advances third-party cyber risk reviews, assessment methodologies, regulatory compliance, and the development of a high-performing cyber risk team.

Requirements

• Minimum of 8 years of related experience in cybersecurity, cyber operations, cyber risk, IT audit, or technology risk.
• Knowledge of frameworks and regulations, including Cyber Risk Institute (CRI) and the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

Nice To Haves

• Bachelor's degree preferred, or equivalent experience.
• Professional certifications such as CISSP, CISA, CRISC, or equivalent are a plus.

Responsibilities

• Lead and develop a team of Cyber Security Due Diligence SMEs conducting technology, cybersecurity, operational resilience, and specialized risk assessments of third parties supporting DTCC's critical services.
• Oversee third-party technology and resilience due diligence activities, ensuring assessments comply with DTCC policies, regulatory expectations, and established service-level agreements.
• Serve as the primary escalation point for complex cybersecurity, technology, resilience, and remediation risks identified during third-party assessments and onboarding.
• Provide subject matter expertise on third-party cyber risk management, emerging regulatory requirements, and industry best practices, including NYSDFS Cybersecurity Regulation, operational resilience, software supply chain risk, fourth-party risk, and encryption key management.
• Direct technology risk assessments, operational resilience reviews, onsite assessments, and specialized reviews for critical third parties, ensuring risks are appropriately assessed, documented, and mitigated.
• Partner with Sourcing, Legal, Enterprise Program Management, the Architecture Review Board, Technology, Resilience, Security, and Business stakeholders on third-party onboarding, contract reviews, and risk-based decision-making.
• Drive remediation management for identified third-party control gaps and assessment findings, ensuring accountability, transparency, and timely risk reduction.
• Develop and present management reporting, key risk indicators, and executive updates on third-party cyber risk, emerging trends, remediation status, and program effectiveness.
• Build and maintain relationships with internal stakeholders, regulators, auditors, and external third parties, representing the Cyber Security Risk Office on strategic third-party cyber risk initiatives.
• Ensure third-party cyber risk management activities support DTCC's overall risk management framework, control environment, regulatory compliance, and operational resilience posture.

Benefits

• Competitive compensation, including base pay and annual incentive.
• Comprehensive health and life insurance and well-being benefits, based on location.
• Pension and retirement benefits.
• Paid time off and personal/family care, and other leaves of absence to support physical, financial, and emotional well-being.
• Flexible/hybrid work model with three days onsite and two days remote.

What This Job Offers

• Job Type: Full-time
• Career Level: Director