Cybersecurity Risk Governance Principal

Cummins•Columbus, IN

4d•$131,400 - $160,600•Remote

About The Position

Cummins is seeking a Cybersecurity Risk Governance Principal for its Corporate Systems/Information Technology organization. This is a remote role focused on leading enterprise cybersecurity risk governance and connecting cybersecurity functions with business stakeholders to prioritize and reduce strategic cyber risks in alignment with business objectives and risk appetite. The role leads the enterprise cyber risk governance process, ensuring risks are consistently identified, assessed, categorized, and reported. It guides risk acceptance and recommends enterprise-wide treatment strategies and investment priorities based on risk reduction value and business impact. The position integrates threat intelligence and emerging threat trends into treatment priorities, coordinates stakeholders across cybersecurity, legal, privacy, compliance, and business units, and ensures treatment plans have accountable owners, funding paths, and timelines. The position also communicates risk posture and treatment progress to senior leadership, translates technical cyber risks into financial, operational, regulatory, and reputational business impacts, and supports enterprise risk management and governance committees. The posting also describes responsibilities for cybersecurity strategy, policy governance, financial planning, team leadership, and cross-functional relationship management.

Requirements

College, university, or equivalent degree in cybersecurity, computer science, information technology, a related subject, or relevant equivalent experience.
5–7 years of cybersecurity experience.
3–5 years of experience in cybersecurity risk management or enterprise risk management.
Familiarity with NIST RMF, FAIR, or quantitative risk methods.
Knowledge of threat intelligence, security operations, identity and access management, cloud security, privacy, legal risk, and regulatory requirements.
Strong communication, analytical, organizational, and collaboration skills.
The position may require licensing for compliance with export controls or sanctions regulations.

Nice To Haves

CISSP, CISM, or equivalent certification.

Responsibilities

Lead the identification, assessment, and mitigation of cybersecurity risks using company policies, risk management frameworks, and data privacy principles.
Develop and execute cybersecurity strategies that address emerging threats, reduce organizational risk, and strengthen security posture.
Drive application of NIST, ISO, ITIL, and COBIT frameworks and standards, aligning controls and processes with organizational objectives and compliance requirements.
Advise business and technology stakeholders on evolving technology solutions while balancing innovation, security, and risk management.
Influence and advocate for cybersecurity policy enhancements that support business needs and enterprise-wide security practices.
Lead Annual Operating Plan development, budget management, forecasting, and resource allocation for cybersecurity initiatives.
Build and lead high-performing teams through recruiting, performance management, coaching, succession planning, and global collaboration.
Foster cross-functional relationships and accountability, ensuring adherence to Cyber, IT, and Corporate policies and delivering business value through Business Relationship Management.
Administer the enterprise cyber risk governance process under the direction of Cybersecurity Governance leadership.
Ensure risks are consistently identified, assessed, categorized, and reported; facilitate risk acceptance governance and recommend actions to decision-makers.
Recommend enterprise-wide treatment strategies that address root causes, and recommend investment priorities based on risk reduction value and business impact.
Partner with BRI and Cyber Threat Intelligence to address emerging threats and translate threat intelligence and trends into strategic treatment priorities.
Assess how evolving threat activity affects enterprise risk exposure.
Convene Cyber Ops, IAM, Infrastructure, Application Security, Compliance, Privacy, Legal, and business stakeholders; resolve roadblocks to risk reduction.
Ensure strategic treatment plans have accountable owners, funding paths, and timelines.
Present risk posture and treatment progress to senior leadership and translate technical risks into financial, operational, regulatory, and reputational impacts.
Support enterprise risk management and governance committees as a cybersecurity risk expert.
Define and govern risk acceptance criteria, approval authorities, oversight requirements, and exception management processes.
Establish and oversee the governance framework for risk acceptance and exceptions.
Balance stakeholder needs; apply business insight; demonstrate self-awareness; develop talent; take a global perspective; manage complexity; persuade; plan and align work; deploy resources effectively; use a strategic mindset; facilitate group discussions; manage cybersecurity risk; and value differences.