IT Risk Officer, Sr

Old National Bank•Lake Elmo, MN

8d•$98,400 - $199,000•Onsite

About The Position

The IT Risk Officer, Sr — Cybersecurity serves as the primary first-line risk professional for Old National Bank’s cybersecurity and information security operational domains. This senior-level role is the IT Risk Office’s subject matter expert and 1LOD owner for five (5) Tier 1 Assessable Units encompassing Security Operations, Identity and Access Management, Data Protection, Vulnerability Management, and Threat Intelligence. The role is a direct response to the bank’s recent organizational change moving the Information Security and Cyber Security Operations function into the IT organization, creating an immediate requirement for dedicated first-line risk coverage across these domains. This role operates at the intersection of technical security operations and enterprise risk governance. The IT Risk Officer, Sr — Cybersecurity must be equally fluent in the language of security practitioners and the language of risk committees, translating technical control performance into risk-rated assessments that drive leadership decisions. The position works daily with the CISO organization, Security Operations Center, Identity and Access Management team, and Data Protection engineering functions while simultaneously managing relationships with Internal Audit, Enterprise Risk Management, and regulatory examiners. In addition to leading day-to-day risk oversight, this role serves as a strategic partner to the CISO, collaborating to define, evolve, and execute the enterprise cybersecurity risk strategy — ensuring the bank's security posture is proactively aligned to its risk appetite, business objectives, and evolving threat landscape. The urgency of this hire reflects the current risk landscape. The IT Risk Officer, Sr — Cybersecurity will serve as the linchpin of the bank’s ability to demonstrate credible first-line oversight to its regulators, auditors, and board.

Requirements

Minimum 6–8 years in cybersecurity, IT risk management, or information security governance, with at least 3 years in a financial services environment.
Demonstrated experience managing cybersecurity risk assessments, audit engagements, and regulatory examinations.
Prior exposure to IAM program governance, PCI DSS compliance, and vulnerability management oversight strongly preferred.
Deep understanding of NIST CSF 2.0; FFIEC Cybersecurity Assessment Tool; PCI DSS v4.0; CIS Critical Security Controls; and OCC Heightened Standards as they apply to information security.
Familiarity with GLBA Safeguards Rule and emerging AI risk frameworks.
Fluency with GRC platforms (Archer, ServiceNow IRM, or equivalent); SIEM tooling (Splunk, Microsoft Sentinel); IAM platforms (SailPoint ISC, Entra/Active Directory); cloud security frameworks (AWS Security Hub, AWS Config, CIS AWS Benchmark); and vulnerability management tools (Tenable, Qualys, or equivalent).
Understanding of DLP, encryption standards, and network segmentation principles.
Ability to assess complex cybersecurity environments, quantify risk exposure, and prioritize remediation efforts based on business impact, regulatory urgency, and exploitability.
Experience developing KRI frameworks and dashboard reporting from operational security data.
Comfort working with large issue datasets and translating findings into executive-ready narratives.
Exceptional written and verbal communication.
Ability to translate highly technical cybersecurity findings into business-risk language for executive and board audiences.
Demonstrated ability to influence security teams, technology leaders, and assurance partners through insight and credibility rather than positional authority.
Experience presenting to risk committees, senior leadership, and external examiners.
Bachelor’s degree in Information Security, Computer Science, Information Systems, or related discipline required.
One or more of the following certifications strongly preferred: CISSP, CISM, CISA, CRISC.

Nice To Haves

Advanced degree a plus.

Responsibilities

Partner directly with the CISO to shape and refine the enterprise cybersecurity risk strategy, ensuring alignment between first-line risk oversight priorities and the security program roadmap.
Translate risk assessment findings, threat intelligence, and regulatory expectations into strategic recommendations that inform investment decisions, capability prioritization, and program maturity targets.
Provide the CISO with a risk-informed perspective on emerging initiatives (e.g., cloud migration, AI adoption, M&A integration) to enable proactive risk positioning rather than reactive remediation.
Co-develop the multi-year cybersecurity risk appetite framework, including thresholds, escalation triggers, and board-reportable risk narratives.
Represent the IT Risk Office in cybersecurity strategy forums and steering committees, ensuring risk considerations are embedded in strategic decision-making at the earliest stages.
Lead comprehensive Risk and Control Self-Assessments (RCSAs) for all five assigned cybersecurity AUs.
Conduct targeted risk assessments of security operations, identity governance, data protection, and vulnerability management programs as needed.
Evaluate control design and operating effectiveness across the cybersecurity control environment, with particular focus on PCI DSS compliance requirements, IAM access governance, and NIST CSF alignment.
Identify control gaps and risk exposures, document findings, and develop risk-rated remediation recommendations in collaboration with domain owners.
Take oversight ownership of the open cybersecurity-related issues in the eGRC system.
Establish structured remediation tracking, prioritization criteria, and escalation pathways for High and Moderate risk items.
Partner with Security Operations, IAM, and Vulnerability Management teams to drive remediation velocity against SLA expectations.
Manage OCC regulatory recommendations in cybersecurity domains through completion, ensuring documentation of evidence sufficient for examiner validation.
Support PCI remediation program oversight, coordinating across network segmentation, access control, encryption, and monitoring workstreams.
Serve as the IT Risk Office’s primary point of contact for all cybersecurity-related regulatory examinations, audit engagements, and second-line assessments.
Support OCC and FFIEC examinations by providing control evidence, facilitating documentation requests, and preparing IT leadership for examiner discussions.
Maintain awareness of emerging regulatory guidance on cybersecurity, AI risk, and third-party technology risk from OCC, FFIEC, and NIST.
Translate examination findings into structured remediation plans with clear ownership and milestone tracking.
Develop, maintain, and report on cybersecurity-domain Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) that provide meaningful visibility into the health of the cybersecurity control environment.
Contribute domain-specific content to executive and board-level risk reporting, the quarterly ISTRM Risk Profile report, and risk appetite monitoring.
Monitor the bank’s NIST CSF 2.0 maturity profile across Identify, Protect, Detect, Respond, and Recover domains, tracking progress toward target maturity.
Provide credible challenge to cybersecurity program metrics and escalate emerging risk themes.
Monitor the evolving cybersecurity threat landscape, with particular focus on AI-accelerated attack vectors, adversarial use of generative AI, and the quantum computing cryptographic migration timeline.
Partner with Threat Management team to ensure threat intelligence findings are translated into actionable risk management activities.
Assess the cyber risk implications of the bank’s AWS cloud migration, including cloud-native security controls, identity federation, and cloud configuration governance.
Provide day-to-day direction, coaching, and development for two direct reports: a Cybersecurity Risk Analyst and a Vulnerability Management Risk Lead.
Define workload allocation, analytical standards, and quality expectations for the sub-team.
Mentor team members in risk assessment methodology, regulatory awareness, and professional development.
Model the IT Risk Office’s culture of rigor, proactivity, and collaborative partnership with business and technology stakeholders.