Segment Risk Manager - Cybersecurity

Huntington National Bank•Columbus, OH

2d•Onsite

About The Position

The Segment Risk Manager oversees and administers operational and regulatory risk strategy programs for a business segment, with a cybersecurity focus. The role leads risk identification, assessment, and effective challenge across Identity and Access Management (IAM), including identity governance and administration, access lifecycle management, authentication and authorization, SSO/federation, and privileged access management. It helps ensure material risks and control gaps are identified, escalated, and managed, and provides risk guidance to support the segment’s strategic goals and regulatory or maturity requirements. The position works with business segment management, audit, and corporate risk; supports executive reporting on the health and status of risks, issues, and controls; and serves as a trusted advisor to its customer when working through ambiguity or new challenges. The position is exempt from overtime pay. The stated workplace type is Office; the posting also notes that certain positions may be eligible for flexible work arrangements, with specific arrangements provided by the hiring team.

Requirements

Bachelor’s degree; in lieu of a bachelor’s degree, four additional years of segment-specific or risk-related experience may be considered.
Minimum of 5 years of experience in Audit, Compliance, Risk Management, or Operational Risk.
Excellent communication skills, including the ability to negotiate internally, often at a senior level.
Organized, responsive, and a thorough problem solver.
Demonstrable cybersecurity risk knowledge based on experience in real-world environments and situations.

Nice To Haves

3+ years of experience supporting IAM processes, procedures, and technologies, including identity governance, access management, authentication, authorization, and privileged access management.
2 years of experience in cybersecurity or a related domain.
2 years of experience with one or more cloud platforms: AWS, Azure, or GCP.
2 years of experience with deployment pipelines, DevOps, containers, and APIs.
2 years of experience with threat modeling.
2 years of experience with cybersecurity-related policy, procedures, or standards governance.
2 years of experience with quantitative or qualitative risk assessments.
At least 7 years of experience in the financial services industry.
At least 4 years of experience working at a Category 3 or higher financial institution.
CISSP, CISM, CISA, GIAC, CIPP/US, or other security/privacy certifications; preferred but not required.

Responsibilities

Evaluate the effectiveness of controls and escalate concerns as appropriate.
Lead risk identification, assessment, and effective challenge across IAM, focusing on identity governance and administration, access lifecycle management, authentication and authorization, SSO/federation, and privileged access management.
Ensure material risks and control gaps are identified, escalated, and managed.
Manage issues through their governance lifecycle, from ideation through validation and closure.
Execute risk assessments against defined scopes and planned initiatives in alignment with enterprise risk management frameworks.
Support and execute processes such as Risk and Control Self-Assessment (RCSA), Exception Management, and assigned business governance groups.
Provide guidance on control design, cybersecurity standards and policies, metrics, and processes to help meet regulatory or maturity requirements.
Support executive reporting on the health and status of the risk, issue, and control portfolio.
Act as a trusted advisor to the customer, offering a risk perspective on ambiguous situations, challenges, and opportunities.
Escalate issues requiring attention to senior management in a timely manner.
Work with business segment management to ensure the risk function supports strategic goals.
Collaborate with audit, business segment, and corporate risk to address issues with plausible action plans and target dates.
Stay aware of credit risk associated with the assigned business segment.
Perform other duties as assigned.