10079845-WD Cybersecurity GRC - AVP (Open)

MUFG • Jersey City, NJ

1d • $90,000 - $153,000 • Hybrid

About The Position

The Cybersecurity GRC - AVP is a member of the CISO of the Americas team within an embedded Cybersecurity GRC function. The role supports governance of the cyber risk lifecycle by monitoring work across contributing teams, tracking status and gaps, and ensuring lifecycle records and outcomes are complete, consistent, and traceable. It also supports the Cyber Risk Institute (CRI) Profile maturity program by coordinating with control owners, tracking assessments and outcomes, maintaining the maturity tracker, and preparing reporting. The role is suited to an organized, detail-oriented cyber risk professional comfortable working across technical and business teams.

The selected colleague will work at an MUFG office or client sites four days per week and remotely one day per week. The role may be eligible for discretionary performance-based bonus and/or incentive compensation. The position’s typical base pay range is $90,000–$153,000 in New York/New Jersey and $90,000–$141,000 outside New York/New Jersey.

Requirements

• 4–7 years of experience in cyber risk, IT risk, GRC, or information security.
• Working knowledge of core cybersecurity domains, including Identity Access Management, Data Security, Configuration Management, Logging, Incident Response, and Secure Software Development Lifecycle, sufficient to understand control outcomes and risk information.
• Working knowledge of cloud security concepts across major cloud service providers.
• Experience writing process documentation and maintaining traceable, audit-ready records.
• Familiarity with cyber-risk frameworks and regulations relevant to banking, including NIST CSF 2.0, the CRI Profile, NIST SP 800-53, the FFIEC IT Handbook, NYDFS Part 500, OCC and FRB expectations, or PCI.
• Ability to work constructively independently and collaboratively with all levels of management and employees.
• Ability to manage multiple priorities concurrently, prioritize effectively, and complete responsibilities efficiently while maintaining quality.
• Excellent analytical, organizational, and conceptual skills.
• Excellent oral and written communication skills.
• Bachelor’s degree in Information Security or a closely related discipline, or equivalent related experience.

Nice To Haves

• Prior audit, assurance, or advisory experience, such as Big 4 cyber risk advisory, internal audit, or IT audit.
• Experience supporting regulatory examinations, matters requiring attention (MRAs), or consent orders within a large financial institution.
• Experience supporting framework-based maturity assessments such as the CRI Profile or NIST CSF.
• One or more of CRISC, CISA, or CompTIA Security+ certifications.
• Experience with GRC platforms and workflow tools.

Responsibilities

• Coordinate cyber risk lifecycle activities across contributing teams, tracking status, handoffs, approvals, and open items through closure.
• Review lifecycle outcomes for completeness, consistency, and traceability, and follow up with responsible teams regarding gaps or delays.
• Escalate missed milestones, unresolved dependencies, and process issues to management, providing context and recommended next steps.
• Maintain process documentation, RACI, and procedures.
• Coordinate with control owners to track CRI Profile maturity assessment completion against program timelines.
• Review assessment outcomes and maturity ratings for consistency, and flag gaps or open items for management review.
• Escalate overdue submissions, unresolved maturity gaps, and remediation delays to management.
• Maintain the maturity tracker and remediation status, and prepare draft reporting and supporting materials.
• Compile KRI/KPI data and prepare recurring status and governance reporting for GRC leadership, highlighting trends, risks, and items requiring decisions or escalation.
• Support internal audit, second-line, regulatory, and other requests by coordinating with responsible teams, tracking requests through completion, and organizing responses.
• Serve as a working-level point of contact for business, system, and control owners and contributing cyber teams; explain requirements and follow up on deliverables.
• Identify opportunities to streamline manual coordination, tracking, and reporting, and support enhancements to GRC tooling.

Benefits

• Comprehensive health and wellness benefits.
• Retirement plans.
• Educational assistance and training programs.
• Income replacement for qualified employees with disabilities.
• Paid maternity and parental bonding leave.
• Paid vacation, sick days, and holidays.
• The role may be eligible for discretionary performance-based bonus and/or incentive compensation.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior