Risk Treatment

Sumitomo Mitsui Banking Corporation•Charlotte, NC

11d•Hybrid

About The Position

SMBC is seeking an experienced Cyber Governance, Risk and Compliance professional to lead a key function within the Risk Treatment Team. The role drives Cybersecurity’s Issue Management and Closure Program, overseeing audit, regulatory, and self-identified issues from intake and creation through remediation validation and closure. Working with Issue Owners, Subject Matter Experts, Internal Audit, and Regulatory stakeholders, the position ensures remediation is documented, evidence packages meet validation expectations, and issues are closed in a timely and sustainable manner. The role establishes governance, reporting, and tracking mechanisms that provide transparency into issue status, closure performance, remediation progress, and emerging risks. It develops executive-level reporting for the CISO and Cybersecurity leadership, monitors closure trends, identifies remediation obstacles, and escalates issues at risk of missing commitments, failing validation, or requiring management intervention. It also drives consistency in issue management, improves closure quality, strengthens stakeholder accountability, and ensures risks from delayed or ineffective remediation are appropriately escalated and managed. The position reports to the Head of Risk Treatment within Cyber Governance, Risk and Compliance. SMBC uses a hybrid workforce model that allows employees to work from home and from an SMBC office; employees must live within a reasonable commuting distance of their office. Specific hybrid schedules are discussed during the interview process, and hybrid work may not be permitted for certain roles.

Requirements

At least 7 years of experience in Cybersecurity, IT Audit, Risk Management, Issue Management, Regulatory Compliance, or Control Governance.
Demonstrated experience managing audit findings, regulatory issues, remediation programs, and closure validation activities within the financial services industry.
Strong understanding of remediation governance, issue lifecycle management, audit practices, and evidence validation requirements.
Experience partnering with Internal Audit, Risk Management, and business stakeholders to drive issue resolution and sustainable remediation.
Strong analytical and reporting skills, including experience developing executive-level dashboards and management reporting.
Proven ability to manage multiple stakeholders, enforce accountability, and escalate risks requiring leadership attention.
Experience with governance, risk, compliance, audit, and issue management platforms and reporting solutions.

Responsibilities

Lead Cybersecurity’s Issue Management and Closure Program, establishing governance, processes, standards, and procedures for end-to-end management of audit, regulatory, and self-identified issues.
Oversee the issue lifecycle, including intake, creation, remediation tracking, validation, closure approval, and post-closure reporting.
Coordinate closure activities across Issue Owners and SMEs, ensuring remediation evidence and supporting documentation meet Internal Audit, Regulatory, and Risk Management validation expectations.
Provide effective challenge and quality assurance over remediation evidence packages, ensuring closure requests are complete, sustainable, and sufficiently documented.
Serve as the primary liaison between Cybersecurity, Internal Audit, and issue owners, coordinating remediation responses, evidence submissions, validation activities, and resolution of audit feedback.
Organize and manage audit responses and remediation documentation, ensuring timely delivery, consistency, quality, and stakeholder accountability.
Facilitate issue validation reviews by coordinating evidence collection, SME engagement, audit inquiries, and closure support.
Develop executive-level reporting for the CISO and Cybersecurity leadership team, and monitor issue closure trends and remediation progress.
Identify and escalate issues at risk of missing remediation commitments, failing validation reviews, or experiencing significant implementation delays.
Drive governance and accountability forums to review remediation progress, closure blockers, validation challenges, and corrective actions.
Escalate issue management risks to Cybersecurity leadership, Issue Owners, Risk Management, and relevant governance committees.
Enhance issue management processes, reporting capabilities, and closure validation practices to improve efficiency, transparency, and effectiveness.
Define business requirements and support implementation of issue management tooling, including workflow automation, evidence repositories, dashboards, metrics, and reporting solutions.
Develop and maintain issue management procedures, standards, and lessons learned to promote consistent remediation and closure activities.