Principal, Cybersecurity Risk

Fidelity Investments•Durham, NC

About The Position

The Enterprise Cybersecurity Risk (ECS Cyber Risk) team is seeking a Principal-level risk professional to create cyber risk analyses for ECS. The role identifies current and emerging cybersecurity risks, determines key risk scenarios for ECS Product Areas, and participates in risk and threat-modeling sessions to prioritize risks. It advises on the risk levels of exceptions and audit findings, with the goals of reducing exceptions and accurately rating findings. The position quantifies cyber risk and presents analyses to technical audiences and senior executives so leaders can make informed decisions based on risk data. The role involves analyzing cybersecurity metrics, integrating information from multiple sources into risk models and tools, and communicating actionable risk to business and technology groups. It works across business lines and technology teams to identify appropriate controls, assess asset inventory and management, compare findings with existing ECS policies, identify gaps and improvement opportunities, and coordinate policy enhancements to address those gaps. The ECS Cyber Risk team identifies, measures, prioritizes, and reports on existing and emerging cyber risk scenarios. It works independently and across business units and technology teams to help senior management make informed decisions about strategy and direction. Fidelity is transitioning to a full-time onsite working model through a phased regional and role-based rollout; current onsite requirements vary, and expectations may evolve. This transition does not apply to fully remote roles.

Requirements

At least 3–5 years of risk experience quantifying cyber risk scenarios and presenting data meaningfully to senior leaders.
Demonstrated experience in cybersecurity risk management, assessment frameworks, and metrics reporting.
Experience managing projects end to end, from gathering data from multiple sources and subject matter experts through tracking, maintenance, and closure.
Proven ability to integrate data into risk analysis tools and communicate progress effectively across multiple lines and levels.
Use and understanding of governance, risk, and compliance tools.
Advanced understanding of NIST 800-53 Cybersecurity Framework, Cybersecurity Risk Institute (CRI), and FAIR.
Effective communication and strong presentation skills with senior leaders.
Ability to analyze metrics that quantify work performed and improvements in cyber risk position.
Critical-thinking skills, including asking detailed questions and vetting answers to uncover discrepancies and gaps.
Ability to work across business lines to influence change and mitigate cyber risk.
Intermediate understanding of risks involving cloud security, access controls, encryption, vendor security, data exfiltration, application security, perimeter security, customer protection, privileged access, denial of service, unpatched vulnerabilities, and end-of-life software.
Ability to operate in a fast-paced environment and complete analyses quickly and accurately while integrating new cybersecurity data into risk models.
Investigator mindset and ability to communicate actionable risk to business and technology groups.

Nice To Haves

CRISC, CISSP, or CISM certification.

Responsibilities

Create cyber risk analyses for ECS and identify current and emerging cybersecurity risk scenarios for ECS Product Areas.
Participate in risk and threat-modeling sessions to prioritize key risks.
Advise on risk levels for exceptions and audit findings to help reduce exceptions and accurately rate findings.
Quantify cyber risk and present analyses to technical audiences and senior leaders to support informed decisions.
Manage projects end to end, including gathering data from multiple sources and subject matter experts, tracking and maintaining work, and bringing projects to closure.
Integrate cybersecurity data into risk analysis tools and models, and communicate project progress across organizational lines and levels.
Analyze metrics to quantify work completed and changes in the organization's cyber risk position.
Investigate metrics and communicate actionable risk to business and technology groups.
Determine appropriate controls for cybersecurity risks and work with asset inventory and asset management information.
Evaluate sources, reports, and industry trends against ECS policies to uncover risk-related gaps and process-improvement opportunities.
Identify where changes are warranted, work with appropriate contacts, and draft policy enhancements to close gaps and maintain progress.
Work across business lines to influence change and help mitigate cyber risk.