Manager, Cyber Risk Operations

Wilton RE • Norwalk, CT

11d • $125,000 - $165,000 • Hybrid

About The Position

We are searching for an experienced Manager, Cyber Risk Operations at our Connecticut office. This role reports to the Chief Information Security Officer and plays a central role in strengthening the organization’s cybersecurity risk management, cyber incident response readiness, and third-party cyber risk oversight. This role is responsible for maintaining visibility into cyber risks, findings, exceptions, vulnerabilities, incidents, and remediation activities while helping leadership make informed, risk-based decisions. The role leads the organization through the initial stages of cybersecurity events by establishing incident command and control, driving event categorization and severity determination, coordinating containment decisions, and managing executive, legal, governance, and operational engagement through incident declaration and stabilization. The Cyber Risk Manager partners closely with Security, IT, Legal, Compliance, Risk Management, Internal Audit, business leaders, and third-party service providers to ensure cyber risks are identified, assessed, documented, owned, remediated, and reported through appropriate governance channels.

Requirements

• Minimum 6 years of progressive experience in cybersecurity, cyber risk management, incident response, technology risk, IT risk, audit, or related disciplines.
• Experience supporting cybersecurity risk management or incident response in insurance, reinsurance, financial services, or another highly regulated environment preferred.
• Demonstrated ability to coordinate cross-functional incident response activities, facilitate risk assessments, maintain risk registers, and communicate risk decisions to leadership.
• Strong understanding of cybersecurity risk management, incident response practices, vulnerability management, third-party risk, NIST Cybersecurity Framework, NYDFS cybersecurity requirements, and audit or regulatory expectations.
• Proven ability to work effectively across security, IT, legal, compliance, risk, audit, business, and vendor teams during both steady-state risk management and active incident response.
• Strong knowledge of cyber risk assessment, risk scoring, risk treatment, incident response coordination, control deficiencies, exception management, and remediation tracking.
• Excellent communication, stakeholder management, executive briefing, and governance reporting skills.
• Experience with GRC platforms, incident response tools, vulnerability management tools, dashboards, and workflow management solutions preferred.
• Ability to translate technical findings, incident details, and cyber risk information into practical business decisions and clear leadership reporting.

Nice To Haves

• Bachelor’s degree required; advanced degree preferred
• Professional certifications such as CISSP, CISM, CRISC, CISA, GIAC, or similar cybersecurity, risk, or incident response certifications are desirable

Responsibilities

• Serve as the designated lead for the organization's initial response to cybersecurity incidents, ensuring timely, coordinated, and effective management of security events from identification through stabilization.
• Establish and maintain initial incident command and control structures during cybersecurity events, ensuring clear accountability, decision-making authority, and communication channels.
• Lead the incident triage process, including validating incident details, coordinating investigations, and driving accurate classification, categorization, and severity determination.
• Facilitate rapid assessment of business impact, regulatory implications, operational disruption, and cyber risk exposure to support executive decision-making.
• Coordinate containment strategy discussions with technical response teams, business stakeholders, legal counsel, and executive leadership to minimize organizational risk and disruption.
• Manage executive, legal, compliance, privacy, and governance engagement throughout incident declaration, containment, and stabilization activities.
• Provide timely and accurate situation reports, executive briefings, and incident status updates to senior leadership.
• Maintain overall accountability for incident coordination and governance activities until the event has been stabilized and formally transitioned to recovery and remediation teams.
• Own and maintain the Cyber Risk Register, ensuring cybersecurity risks, control deficiencies, audit findings, vulnerabilities, compensating controls, and approved risk exceptions are accurately documented and regularly reviewed.
• Facilitate the identification, analysis, assessment, scoring, and prioritization of cybersecurity risks across the organization.
• Partner with business, technology, and security stakeholders to develop and implement risk treatment plans, including mitigation, transfer, acceptance, and avoidance strategies.
• Track risk mitigation activities, remediation efforts, and exception management processes to ensure timely execution and accountability.
• Monitor cybersecurity trends, emerging threats, incidents, vulnerability data, control weaknesses, audit observations, and industry developments to identify evolving risk exposure.
• Validate that cybersecurity findings, risk exceptions, and control deficiencies have clearly assigned owners, documented remediation plans, defined milestones, and target completion dates.
• Conduct periodic reviews of risks, findings, and approved exceptions to validate continued business justification, effectiveness of compensating controls, and current risk ratings.
• Challenge risk assumptions and facilitate informed risk acceptance decisions by ensuring leadership has sufficient visibility into residual risk and business impact.
• Develop and maintain cybersecurity risk reporting for executive management, risk committees, audit committees, and Board-level stakeholders.
• Design and track cybersecurity key risk indicators (KRIs), key performance indicators (KPIs), and operational metrics to measure program effectiveness and risk trends.
• Prepare executive dashboards and governance reports that communicate cybersecurity posture, emerging risks, remediation progress, and risk treatment status.
• Provide data-driven recommendations to leadership regarding risk priorities, investment decisions, and strategic cybersecurity initiatives.
• Coordinate the collection, review, and presentation of cybersecurity risk documentation, evidence, and supporting materials during audit and regulatory activities.
• Monitor regulatory and industry requirements to ensure risk management practices remain aligned with applicable standards, frameworks, and obligations.
• Assist in the development and maintenance of policies, standards, procedures, and risk management documentation supporting the cybersecurity program.
• Ensure third-party cybersecurity risks, vendor findings, control deficiencies, and risk exceptions are appropriately documented and tracked within enterprise risk management processes and the IT Risk Register.
• Partner with procurement, legal, technology, and business stakeholders to evaluate cybersecurity risks associated with vendors, service providers, and strategic partners.
• Support vendor onboarding and due diligence activities, including cybersecurity assessments, security reviews, evidence evaluations, and risk recommendations.
• Participate in contract reviews to ensure cybersecurity, privacy, incident notification, audit, business continuity, and security control requirements are incorporated as appropriate.
• Lead the development of a Business Impact Analysis (BIA) framework for critical business processes and services.
• Facilitate identification of critical business functions, dependencies, recovery objectives, and operational impacts associated with cyber and technology disruptions.
• Partner with business leaders to assess and document third-party dependencies that could materially impact business operations.
• Ensure BIA outputs are incorporated into cybersecurity risk assessments, third-party risk evaluations, incident response planning, and business continuity strategies.
• Support cross-functional resilience initiatives by helping business units understand and manage risks associated with critical systems, processes, and external service providers.

Benefits

• Competitive vacation and sick time, including company-paid holidays, floating holidays and early closing days
• 401(k) plan with employer contribution
• Profit Sharing Program
• Competitive parental leave
• Health, vision, dental, and life insurance, including access to health and wellness programs
• Actuarial Development Program (ADP) for Actuarial employees taking exams
• Employee Assistance Program (EAP)

What This Job Offers

• Job Type: Full-time
• Career Level: Manager