10079845-WD Cybersecurity GRC - AVP (Open)

Mitsubishi UFJ Financial Group•Tampa, FL

2d•Hybrid

About The Position

The Cybersecurity GRC - AVP is a member of the CISO of the Americas team within an embedded Cybersecurity GRC function. The role supports governance of the cyber risk lifecycle by monitoring execution across contributing teams, tracking status and gaps, and ensuring lifecycle records and outcomes are complete, consistent, and traceable. It also supports the Cyber Risk Institute (CRI) Profile maturity program by coordinating with control owners, tracking assessment progress and outcomes, maintaining the maturity tracker, and preparing maturity reporting. The role is suited to an organized, detail-oriented cyber risk professional comfortable working across technical and business teams. The selected colleague will work at an MUFG office or client sites four days per week and remotely one day per week. The role may be eligible for discretionary performance-based bonus and/or incentive compensation. The typical base pay range is $90,000–$153,000 in New York/New Jersey and $90,000–$141,000 outside New York/New Jersey.

Requirements

4–7 years of experience in cyber risk, IT risk, GRC, or information security.
Working knowledge of cybersecurity domains including Identity Access Management, Data Security, Configuration Management, Logging, Incident Response, and Secure Software Development Lifecycle sufficient to understand control outcomes and risk information.
Working knowledge of cloud security concepts across major cloud service providers.
Experience writing process documentation and maintaining traceable, audit-ready records.
Familiarity with cyber risk banking frameworks and regulations, including NIST CSF 2.0, the CRI Profile, NIST SP 800-53, the FFIEC IT Handbook, NYDFS Part 500, and OCC and FRB expectations, or other frameworks such as PCI.
Ability to work constructively both independently and collaboratively with all levels of management and employees.
Ability to manage and prioritize multiple concurrent responsibilities and complete them efficiently while maintaining high quality.
Excellent analytical, organizational, and conceptual skills.
Excellent oral and written communication skills.
Bachelor's degree in Information Security or a closely related discipline, or equivalent related experience.

Nice To Haves

Prior audit, assurance, or advisory experience, such as Big 4 cyber risk advisory, internal audit, or IT audit.
Experience supporting regulatory examinations, matters requiring attention (MRAs), or consent orders within a large financial institution.
Experience supporting framework-based maturity assessments such as the CRI Profile or NIST CSF.
One or more of CRISC, CISA, or CompTIA Security+ certifications.
Experience with GRC platforms and workflow tools.

Responsibilities

Coordinate cyber risk lifecycle activities across contributing teams, tracking status, handoffs, approvals, and open items through closure.
Review lifecycle outcomes for completeness, consistency, and traceability; follow up with responsible teams on gaps or delays.
Escalate missed milestones, unresolved dependencies, and process issues to management with context and recommended next steps.
Maintain process documentation, RACI, and procedures.
Coordinate with control owners to track completion of CRI Profile maturity assessments against program timelines.
Review assessment outcomes and maturity ratings for consistency, and flag gaps or open items for management review.
Escalate overdue submissions, unresolved maturity gaps, and remediation delays to management.
Maintain the maturity tracker and remediation status, and prepare draft reporting and supporting materials for submissions.
Compile KRI/KPI data and prepare recurring status and governance reporting for GRC leadership, highlighting trends, risks, and items requiring decisions or escalation.
Support responses to internal audit, second line, regulatory, and other requests by coordinating with responsible teams, tracking requests to completion, and organizing responses.
Serve as a working-level point of contact for business, system, and control owners and contributing cyber teams; explain requirements clearly and follow up on deliverables.
Identify opportunities to streamline manual coordination, tracking, and reporting tasks, and support enhancements to GRC tooling.