Director, Risk Advisory - Global Payment Networks

Capital One • McLean, VA

2d • Hybrid

About The Position

Capital One is seeking a Director, Risk Advisory to apply cyber best practices to assess current-state security, identify gaps, evaluate cyber risk and business impact, and develop and prioritize mitigation strategies. The role participates in the design and implementation of cyber control programs and serves as a cybersecurity subject matter expert in risk frameworks, information security risk assessments, information risk controls, governance, data analysis, reporting, and customer engagement.

The position works across technology systems—including networks, applications, cloud computing, and data—to assess vulnerabilities and threats and advise on appropriate safeguards. It uses existing tools and reporting to analyze data, inform cyber risk decisions, support policy changes, and communicate findings. The role also evaluates industry practices and regulatory developments, recommends practical changes to policies and controls, manages action plans and stakeholder engagement, and advises Accountable Executives on cyber risk through risk forums and established processes.

This is a hybrid position subject to Capital One’s on-site presence policy. The role is eligible for performance-based incentive compensation. Capital One will not sponsor new employment authorization for this position.

Requirements

• Bachelor’s degree or military experience.
• At least 9 years of experience in one or more of the following areas: technology (software delivery, distributed systems, cloud-native architecture, or infrastructure as code); cybersecurity (identity and access management, application security, cloud security, or data protection); technology auditing; systems risk management; technology risk assessments; resilience engineering; chaos engineering; or site reliability engineering.
• Ability to assess technology systems, vulnerabilities, cyber threats, and associated risk.
• Ability to analyze data, prioritize risks, communicate findings, and engage stakeholders.

Nice To Haves

• Master’s degree in Information Technology, Cybersecurity, or equivalent.
• At least 9 years of risk management experience in a cyber or information security practice.
• At least 9 years of experience in cloud computing, including AWS, GCP, or Azure.
• At least 9 years of experience in a second-line or oversight role at a financial institution or regulatory agency.
• Third-party risk management experience.
• Professional security certification or professional risk management certification.
• Certified Information Systems Security Professional (CISSP).
• Certified Information Systems Auditor (CISA).
• Certified in Risk and Information Systems Control (CRISC).
• Open FAIR Certified.
• Ability to use code to perform or automate analysis and repeatable tasks (not a baseline requirement).

Responsibilities

• Apply cyber best practices to assess current state, identify gaps, and assess cyber risk, threats, and business impact.
• Define mitigation strategies, prioritize recommendations, and escalate them as appropriate.
• Participate in the design and implementation of cyber control programs.
• Use an aggregate understanding of technology systems, including networks, applications, cloud computing, and data, to identify risk.
• Assess operating-system vulnerabilities and recognize the severity and risk of potential issues.
• Understand major categories of cyber threats, how they may occur in the organization’s environment, and measures to safeguard the enterprise.
• Use existing reporting and tools to analyze projects, efforts, and datasets, and use data to inform policies and drive change.
• Interpret reporting metrics and communicate cyber risk.
• Use tools such as Excel or Google Sheets to analyze data and create charts supporting cyber risk management.
• Analyze data, assess risk, prioritize published vulnerabilities and potential risks, distinguish critical, high-risk, and low-risk issues, and escalate as appropriate.
• Research and evaluate industry practices and applicable regulatory changes affecting cybersecurity policies or programs, and recommend practical solutions.
• Recommend changes to policies, procedures, and control programs to mitigate evolving risks.
• Challenge cyber control programs as part of first-line duties and escalate risks where appropriate.
• Manage program lifecycles, including documenting and communicating action plans, impediments, and risks, and engaging stakeholders.
• Report on vulnerability assessments to ensure proper functionality and alignment with Information Security Standards.
• Advise Accountable Executives on cyber-related risk through relevant risk forums and existing processes such as exception and issue management.
• Monitor the evolving cyber threat landscape to keep cyber risk mitigation relevant.

Benefits

• Performance-based incentive compensation, which may include cash bonuses and/or long-term incentives.
• Comprehensive health, financial, and other benefits supporting total well-being; eligibility varies by employment status and management level.

What This Job Offers

• Job Type: Full-time
• Career Level: Director