IT Risk & Control Director - Cybersecurity

Huntington National Bank•Minnetonka, MN

17d•Onsite

About The Position

The Technology Risk & Control Director – Cybersecurity is a senior front-line Technology Risk leader who provides risk insight, advisory support, and constructive challenge across cybersecurity and information protection. The role partners with Cybersecurity and Technology leaders who own the relevant standards, procedures, controls, metrics, and operational practices; it does not assume those ownership responsibilities. The Director helps leaders understand risk exposure, assess the effectiveness and sustainability of the control environment, identify emerging or systemic risk themes, and make informed risk decisions. The position provides risk expertise across Identity and Access Management (IAM), Privileged Access Management (PAM), Data Protection, Cloud Security, Vulnerability and Exposure Management, Application Security, Security Architecture, Cybersecurity Operations, and related or evolving cybersecurity domains. The leader translates technical conditions into business risk, control implications, risk trends, and executive insights; collaborates with stakeholders across Technology, Cybersecurity, Data, business-aligned technology teams, Independent Risk, Compliance, Legal, Privacy, and Audit; and maintains clear role boundaries within the three lines model. The Director also leads and develops a high-performing Technology Risk team. The position is office-based under the stated workplace type, although certain positions outside the branch network may be eligible for flexible arrangements. The hiring team will provide specific arrangements.

Requirements

Bachelor's degree or equivalent level of work experience.
10+ years in a related role.

Nice To Haves

Significant experience in a first-line technology risk, cybersecurity risk, information security risk, or comparable risk and control function in a financial institution or other highly regulated organization.
Demonstrated knowledge across multiple cybersecurity disciplines, particularly IAM/PAM, Data Protection, Cloud Security, Vulnerability Management, cybersecurity controls, or related security domains.
Experience operating within the three lines model and partnering with Technology/Cybersecurity control owners, Independent Risk, Compliance, Internal Audit, and regulatory stakeholders.
Experience advising senior leaders on cybersecurity and technology risks without assuming responsibility for the underlying operational process or control.
Ability to translate complex cybersecurity conditions into business risk, control implications, residual risk considerations, risk trends, and decision-oriented executive insights.
Experience leading senior professionals and developing risk talent within complex, matrixed organizations.
Deep understanding of IAM and PAM, including identity governance, authentication, authorization, MFA, privileged access, entitlement management, access certification, service/non-human identities, and identity lifecycle management.
Strong understanding of Data Protection, including sensitive data protection, encryption, key management, DLP, access to sensitive information, and information lifecycle considerations.
Strong understanding of Cloud Security, including identity and access, workload protection, infrastructure security, configuration, encryption, secrets management, and cloud governance.
Strong understanding of Vulnerability and Exposure Management, Application Security, Security Architecture, endpoint and network security, Cybersecurity Operations, and incident-related risk.
Working knowledge of cybersecurity frameworks and practices such as NIST Cybersecurity Framework, NIST SP 800-53, NIST Zero Trust guidance, CIS Controls, and ISO/IEC 27001.
Experience assessing risk in major public-cloud environments such as Microsoft Azure, Amazon Web Services (AWS), or Google Cloud Platform (GCP).
Experience with risk assessments, RCSAs/control assessments, issue management, risk acceptance, remediation governance, control testing results, KRIs, audit engagement, and regulatory examinations.
Ability to identify systemic and aggregate risk themes across cybersecurity findings, metrics, control deficiencies, risk acceptances, exceptions, and other risk indicators.
Executive presence and ability to communicate cybersecurity risk to senior management, Board-level audiences, regulators, Independent Risk, and Internal Audit.
Ability to provide constructive and credible challenge while maintaining collaborative relationships and clear ownership boundaries.
Strong written and verbal communication skills, including the ability to convey complex cybersecurity concepts as concise, business-oriented risk insights and recommendations.
Relevant professional certifications such as CISSP, CISM, CRISC, CISA, CCSP, or comparable cybersecurity/risk credentials.

Responsibilities

Serve as a senior Technology Risk partner to Cybersecurity and Technology leadership, providing risk insight, advice, and constructive challenge.
Build collaborative relationships with Cybersecurity, Technology, Data, business-aligned technology teams, Independent Risk, Compliance, Legal, Privacy, Audit, and other enterprise stakeholders.
Provide risk insight across IAM, PAM, authentication and authorization, identity governance, Data Protection, Cloud Security, Vulnerability and Exposure Management, Application Security, Security Architecture, Cyber Operations, endpoint and network security, and cyber incident risk.
Partner with control owners to assess risks involving identity lifecycle management, privileged access, excessive or unauthorized access, service and non-human identities, entitlements, authentication, access certification, and segregation of duties.
Advise on cloud adoption and cloud-native technology risks, including identity, privileged access, sensitive data, security configuration, workload protection, encryption, secrets management, and monitoring.
Provide independent risk perspectives on data security and protection practices, including encryption, key management, DLP, sensitive-data access, and information lifecycle controls.
Help interpret vulnerability and exposure information and translate technical conditions into business impact, risk concentration, prioritization considerations, and executive-level risk insight.
Provide risk input into standards, procedures, metrics, KRIs, risk assessments, control assessments, risk acceptances, exceptions, issues, and remediation strategies while preserving accountability with the appropriate owner.
Analyze cybersecurity risk across domains to identify common themes, systemic conditions, risk concentrations, control dependencies, and emerging risks.
Help ensure cybersecurity findings, control deficiencies, exceptions, and other risk indicators are appropriately represented in the broader Technology Risk profile.
Partner with issue and control owners on root-cause analysis, risk articulation, remediation strategies, risk acceptance, and closure considerations without taking ownership of remediation or control execution.
Provide risk insight into cybersecurity metrics, KRIs, and risk appetite measures, distinguishing actual risk exposure from operational performance, program delivery, or activity measures.
Translate cybersecurity conditions into potential business impact, including unauthorized access, data compromise, fraud or unauthorized money movement, service disruption, customer impact, financial loss, and regulatory exposure where applicable.
Prepare and contribute to executive-level risk assessments, management and Board reporting, regulatory responses, issue updates, and decision materials.
Participate in Cybersecurity and Technology governance forums, raising risk trends, emerging concerns, cross-domain dependencies, and matters requiring leadership attention or decisions.
Maintain clear three-lines-model role boundaries while supporting Technology and Cybersecurity ownership and engaging effectively with Independent Risk and Internal Audit.
Monitor developments in cyber threats, technology architecture, regulation, industry practices, cloud technologies, identity, data protection, and emerging technologies.
Lead and develop a high-performing Technology Risk team with cybersecurity expertise, business acumen, collaborative partnership, sound judgment, and actionable risk insight.
Perform other duties as assigned.