Director, Risk Advisory - Global Payment Networks

Capital One • McLean, VA

4d • $230,400 - $263,000 • Hybrid

About The Position

Capital One is seeking a technology risk and analysis professional to help drive cybersecurity governance, resilience, and risk transformation. The role applies cyber best practices to assess current states, identify gaps, and evaluate cyber risks, threats, and business impacts. It defines and prioritizes mitigation strategies, escalates recommendations, and participates in designing and implementing cyber control programs.

The position serves as a cybersecurity subject-matter expert in risk frameworks, information security risk assessments and controls, regulatory and internal governance, data analysis, metrics and reporting, and customer engagement. It is designated as hybrid, with on-site attendance required in accordance with Capital One’s hybrid policy at the employee’s designated office location.

The role is eligible for performance-based incentive compensation, which may include cash bonuses and/or long-term incentives. Capital One also describes its benefits as a comprehensive, competitive, and inclusive set of health, financial, and other benefits; eligibility varies by employment and management status.

Requirements

• Bachelor’s degree or military experience.
• At least 9 years of experience in one or a combination of technology, cybersecurity, technology auditing, systems risk management, technology risk assessments, resilience engineering, chaos engineering, or site reliability engineering. Listed areas include software delivery, distributed systems, cloud-native architecture, infrastructure as code, identity and access management, application security, cloud security, data protection, operational resilience, business continuity, disaster recovery, high availability, fault injection, blast radius mitigation, automated security validation, SLAs or SLOs, observability, and incident response.
• Ability to analyze and explain vulnerability assessment findings and their alignment with Information Security Standards.
• The employer will not sponsor a new applicant for employment authorization or provide immigration-related support for this position.

Nice To Haves

• Master’s degree in Information Technology, Cybersecurity, or equivalent.
• 9 or more years of risk management experience in a cyber or information security practice.
• 9 or more years of cloud computing experience with AWS, GCP, or Azure.
• 9 or more years of experience in a second-line or oversight role at a financial institution or regulatory agency.
• Third-party risk management experience.
• Professional security certification or professional risk management certification.
• Certified Information Systems Security Professional (CISSP).
• Certified Information Systems Auditor (CISA).
• Certified in Risk and Information Systems Control (CRISC).
• Open FAIR certification.
• Ability to use code to perform or automate analysis and repeatable tasks; coding is not a baseline requirement.

Responsibilities

• Understand technology systems at an aggregate level, including networks, applications, cloud computing, and data.
• Maintain broad knowledge of relevant operating systems and vulnerabilities to recognize and assess the severity of potential issues.
• Understand major categories of cyber threats, how they may occur in the company’s environment, and measures to safeguard the enterprise.
• Use reporting and tools to analyze projects, efforts, or datasets, and use data to inform policies and drive change.
• Understand reporting metrics and provide insight into cyber risk.
• Use tools such as Excel or Google Sheets to analyze data and create charts supporting cyber risk management.
• Analyze data, assess risk, and prioritize published vulnerabilities and potential risks by severity; escalate issues as appropriate.
• Research and evaluate industry practices and regulatory changes affecting cybersecurity policies or programs, and recommend practical solutions to complex issues.
• Recommend changes to policies, procedures, and control programs to mitigate evolving risks.
• Challenge cyber control programs as part of first-line duties and escalate risks where appropriate.
• Manage program lifecycles, including documenting and communicating action plans, impediments, and risks, and engaging stakeholders.
• Report on vulnerability assessments to check functionality and alignment with Information Security Standards; understand and explain findings, without necessarily resolving them.
• Advise Accountable Executives about cyber-related risk through relevant risk forums and established processes such as exception and issue management.
• Keep pace with the evolving cyber threat landscape to maintain relevant cyber risk mitigation.
• Apply cybersecurity expertise to assess current state, identify gaps, evaluate cyber risk, threats, and business impact; define mitigation strategies, prioritize and escalate recommendations, and participate in the design and implementation of cyber control programs.

Benefits

• Comprehensive health, financial, and other benefits supporting total well-being; eligibility varies by full- or part-time status, exempt or non-exempt status, and management level.
• Performance-based incentive compensation, which may include cash bonuses and/or long-term incentives.

What This Job Offers

• Job Type: Full-time
• Career Level: Director