Risk Treatment

SMBC•Charlotte, NC

10d•Hybrid

About The Position

SMBC is seeking an experienced Cyber Governance, Risk and Compliance professional to lead a critical function supporting Cybersecurity’s risk reduction and control improvement objectives. Reporting to the Head of Risk Treatment within Cyber Governance, Risk and Compliance, this role leads the Risk Treatment Team’s Cybersecurity Issue Management and Closure Program. The position oversees audit, regulatory, and self-identified issues from intake and creation through remediation, validation, closure, and post-closure reporting. The role works closely with Issue Owners, Subject Matter Experts, Internal Audit, Regulatory stakeholders, Risk Management, and Cybersecurity leadership. It ensures remediation is documented appropriately, evidence packages meet validation expectations, and issues are closed in a timely and sustainable manner. The role establishes governance, tracking, and reporting mechanisms that provide transparency into issue status, closure performance, remediation progress, and emerging risks. It develops executive-level reporting for the CISO and Cybersecurity leadership team, identifies obstacles and at-risk issues, and escalates matters requiring management intervention. The position also drives consistency and accountability across issue management processes, improves closure quality, supports issue management tooling and reporting solutions, and promotes continuous improvement in remediation and closure practices. SMBC uses a hybrid workforce model; employees must live within a reasonable commuting distance of their office location. Specific hybrid schedules are discussed during the interview process.

Requirements

At least 7 years of experience in Cybersecurity, IT Audit, Risk Management, Issue Management, Regulatory Compliance, or Control Governance.
Demonstrated experience managing audit findings, regulatory issues, remediation programs, and closure validation within the financial services industry.
Strong understanding of remediation governance, issue lifecycle management, audit practices, and evidence validation requirements.
Experience partnering with Internal Audit, Risk Management, and business stakeholders to drive issue resolution and sustainable remediation.
Strong analytical and reporting skills, including experience developing executive-level dashboards and management reporting.
Proven ability to manage multiple stakeholders, enforce accountability, and escalate risks requiring leadership attention.
Experience with governance, risk, compliance, audit, and issue management platforms and reporting solutions.
Must live within a reasonable commuting distance of the office location.

Responsibilities

Lead Cybersecurity’s Issue Management and Closure Program, establishing governance, processes, standards, and procedures for audit, regulatory, and self-identified issues.
Oversee the issue lifecycle, including intake, creation, remediation tracking, validation, closure approval, and post-closure reporting.
Coordinate closure activities with Issue Owners and SMEs, ensuring remediation evidence and documentation meet Internal Audit, Regulatory, and Risk Management validation expectations.
Provide effective challenge and quality assurance for remediation evidence packages to ensure closure requests are complete, sustainable, and adequately documented.
Act as the primary liaison between Cybersecurity, Internal Audit, and issue owners to coordinate remediation responses, closure evidence submissions, validation activities, and audit feedback resolution.
Organize and manage audit responses and remediation documentation, ensuring timely delivery, consistency, quality, and accountability.
Facilitate issue validation reviews by coordinating evidence collection, SME engagement, audit inquiries, and closure support.
Develop executive-level reporting for the CISO and Cybersecurity leadership team; monitor issue closure trends, remediation progress, and emerging risks.
Identify and escalate issues at risk of missing remediation commitments, failing validation reviews, or experiencing significant implementation delays.
Drive governance and accountability forums to review remediation progress, closure blockers, validation challenges, and corrective actions.
Escalate issue management risks to Cybersecurity leadership, Issue Owners, Risk Management, and relevant governance committees.
Enhance issue management processes, reporting capabilities, and closure validation practices to improve efficiency, transparency, and effectiveness.
Define business requirements and support implementation of issue management tooling, including workflow automation, evidence repositories, dashboards, metrics, and reporting solutions.
Develop and maintain issue management procedures, standards, and lessons learned to promote consistent and continuously improving remediation and closure activities.