Information Security Governance & Risk Officer

BankNewport•Middletown, RI

3d•Hybrid

About The Position

The Information Security Governance & Risk Officer leads BankNewport’s information security governance, risk, compliance, resiliency, awareness, and assurance programs. The role reports to the Chief Information Security Officer (CISO) and works alongside the Information Security Operations Officer. It provides independent oversight of vendor and technology risk, risk assessments, policy governance, audits and examinations, issue remediation, business continuity and disaster recovery, security awareness and phishing testing, governance metrics, and related regulatory obligations. The role translates regulatory, policy, and risk requirements into practical oversight, remediation, and reporting. The CISO retains accountability for the Information Security Program, strategy, risk acceptance, major incident command, and executive and Board reporting. Technology, business, vendor, and system owners remain responsible for implementing and operating controls. The position leads assigned governance and risk programs, supervises assigned Information Security staff (initially the Information Security Analyst), and partners with internal and external stakeholders. It may require off-hours work, nights, and weekends due to emerging cyber threats. The position must meet the Bank’s applicable hybrid work schedule requirements and includes travel to the primary work location, other Bank properties, and work-related activities or events.

Requirements

Bachelor’s degree in information security, cybersecurity, risk management, audit, information technology, business, or a related discipline, or equivalent training, certification, and experience.
Five or more years of progressively responsible experience in information security governance, technology or third-party risk, audit, compliance, business continuity, or a related field.
Demonstrated experience leading multiple GRC disciplines and producing management or committee reporting, maintaining audit-ready documentation, coordinating remediation, and communicating with senior leaders, auditors, or examiners.
Advanced knowledge of information security governance, enterprise and technology risk, third-party risk, control assurance, issue management, policy governance, audit and examination practices, and operational resilience.
Knowledge of financial-services laws and guidance, including GLBA, the Interagency Guidelines Establishing Information Security Standards, FFIEC guidance, applicable privacy requirements, and Bank policies.
Knowledge of the NIST Cybersecurity Framework, NIST AI Risk Management Framework, NICE Framework concepts, and other relevant control and risk frameworks.
Ability to evaluate SOC reports, assessments, vendor and contractual evidence, controls, resiliency materials, audit findings, and remediation evidence.
Ability to design sustainable governance processes, set measurable requirements, analyze risk trends, distinguish oversight from implementation, and translate complex requirements into practical action.
Ability to document defensible conclusions, communicate material issues, influence stakeholders, and maintain accountability for deliverables and remediation.
Strong leadership, staff development, writing, presentation, analytical, organizational, project-management, judgment, discretion, relationship-management, and learning agility.
Ability to travel independently to the position’s primary work location, other Bank properties, and work-related activities or events.
Ability to communicate effectively and exchange accurate information and ideas.
Ability to independently operate a computer and office equipment needed to perform the position’s primary functions.
Ability to sit or stand at a workspace and use a computer or other equipment for prolonged periods.
Ability to move office items weighing up to 35 pounds.
Ability to meet the Bank’s applicable hybrid work schedule requirements.
This role may require off-hours work, nights, and weekends.

Nice To Haves

Experience in financial services or another regulated environment.
Relevant certifications such as CISA, CISM, CRISC, CISSP, CBCP, or equivalent.
Prior people-management, team-lead, program-lead, or staff-development experience.

Responsibilities

Establish consistent governance methods, schedules, documentation, metrics, evidence standards, and issue-management practices across assigned programs.
Work with Legal and Compliance to translate applicable laws, guidance, Bank policies, risk appetite, and security standards into program requirements, control expectations, reporting, and escalation criteria.
Independently assess risks and controls, confirm ownership and timely remediation, validate outcomes, and escalate residual risk while distinguishing oversight from control implementation and operation.
Lead risk methodologies, inventories, scoring, assessment schedules, and reporting for information security, technology, customer information, third parties, cloud services, projects, business changes, and emerging risks.
Coordinate stakeholder assessments of threats, vulnerabilities, control effectiveness, business impact, data sensitivity, criticality, dependencies, third-party exposure, compensating controls, and residual risk; recommend treatment.
Lead Information Security due diligence and ongoing third-party oversight, including onboarding, risk tiering, periodic and material-change reviews, contractual and resiliency requirements, issue follow-up, and offboarding.
Maintain an integrated register of risks, findings, exceptions, compensating controls, owners, due dates, evidence, and status; coordinate remediation and escalate material, repeat, accepted, or overdue exposure.
Validate closure through evidence or testing, identify themes and priorities, and maintain audit-ready risk records and recommendations for management, committees, examinations, and independent review.
Define Information Security scope, priorities, and engagement for audits, regulatory examinations, independent assessments, and control testing assigned by the CISO.
Coordinate audit and examination requests, interviews, evidence, responses, action plans, status tracking, and closure; maintain audit-ready records of ownership, approvals, exceptions, testing, remediation, and reporting.
Map regulatory and framework requirements to policies, risks, controls, owners, evidence, and testing; identify gaps and recommend improvements.
Monitor relevant laws, guidance, examination expectations, and industry practices, and assess their impact on the Information Security Program.
Coordinate the lifecycle of assigned information security policies, standards, methodologies, procedures, and governance documents, including drafting, review, approval, publication, acknowledgment, exceptions, and periodic review.
Keep governance documents aligned with the Bank’s risk profile, operating model, regulatory obligations, supporting procedures, and control practices; maintain clear ownership, review dates, approvals, revision history, mappings, and exception records.
Partner with the CISO, Legal, Compliance, Enterprise Risk Management, Technology, Human Resources, and business stakeholders to resolve interpretation and implementation questions.
Lead Information Security oversight of the Business Continuity Program and operational resilience, including business impact analyses, plan governance, dependencies, testing, exercises, issues, and reporting.
Coordinate with business owners, Technology, Facilities, vendors, Crisis Management, and other stakeholders to maintain recovery requirements, plans, objectives, contacts, dependencies, and testing evidence.
Assess disaster recovery test scope, results, exceptions, lessons learned, and remediation; report material risks and recommendations without assuming responsibility for Technology implementation or business-owned recovery procedures.
Own the Bank’s information security awareness and training program, including annual and role-based training, targeted education, policy communications, campaigns, and employee guidance.
Lead phishing and social-engineering testing, including scenarios, execution, analysis, follow-up education, exceptions, metrics, improvement actions, and escalation.
Use risk trends, incidents, audit findings, employee feedback, threat intelligence, and business changes to refine awareness and testing priorities.
Support the CISO’s governance of artificial intelligence, automation, cloud services, and emerging capabilities through inventories, intake, risk tiering, assessments, approvals, exceptions, KRIs, documentation, and lifecycle review.
Coordinate cross-functional assessment of security, privacy, regulatory, third-party, resiliency, human-oversight, and operational risks; monitor compliance and maintain review evidence.
Escalate high-risk use cases, control gaps, exceptions, and residual-risk decisions requiring CISO or executive authority.
Maintain incident response governance, including plans, roles, escalation criteria, regulatory and contractual requirements, exercises, lessons learned, and corrective actions.
Support the CISO and Security Operations during incidents by coordinating governance activities, maintaining decision and evidence records, tracking notifications and commitments, and assisting with management, regulatory, audit, and committee reporting.
Provide incident governance and risk support without assuming the CISO’s incident-command authority or Security Operations’ technical-response responsibilities.
Set priorities, coordinate dependencies, remove delivery obstacles, and drive consistent execution and improvement across governance and risk initiatives.
Supervise, coach, prioritize work, review quality, manage performance, and develop assigned Information Security staff, including building the Information Security Analyst’s GRC and backup capabilities.
Prepare concise dashboards, KRIs, risk statements, committee materials, status updates, and recommendations for the CISO, management, auditors, examiners, and governance bodies.
Build effective relationships across Technology, Risk Management, Compliance, Legal, Procurement, Human Resources, Internal Audit, Finance, business units, vendors, and service providers.
Represent Information Security in delegated meetings, projects, committees, audits, and examinations; provide defined coverage during the CISO’s absence and escalate matters requiring CISO or executive authority.
Support strategy, budgets, staffing, roadmaps, succession planning, metrics, and measurable triggers for future capability or investment needs.
Work independently within approved policies, standards, risk tolerances, methodologies, and program requirements; exercise sound judgment, lead assigned programs, challenge unsupported conclusions, and escalate material risks, exceptions, policy deviations, overdue remediation, examination concerns, and decisions requiring risk acceptance or executive authority.
Directly supervise assigned Information Security staff, initially the Information Security Analyst, including work prioritization, coaching, quality review, development, performance management, cross-training, continuity planning, and accountability.
Support bank-wide efforts to understand, measure, monitor, reduce, control, and report risk efficiently and cost-effectively; support the Bank’s “All In” initiative, provide sales support to departments, understand support metrics, and improve Bank efficiencies.