Sr. Cybersecurity Operational Risk Officer

KeyBank • Brooklyn, OH

9d • $96,000 - $181,000 • Hybrid

About The Position

Reporting to the Director of Cybersecurity Risk Oversight, this second-line-of-defense risk management role provides independent oversight and risk management subject matter expertise to first-line business units and their corresponding Business Risk Teams. The position oversees cybersecurity and information security risk for the Key Technology Services line of business, as well as technology and information security risks across enterprise areas that manage technology, data, and AI/ML systems. It calls for experience across cybersecurity domains—including security operations, network and cloud security architecture, identity and access management, and cyber defenses—and knowledge of emerging AI security risks and AI governance frameworks. The role identifies material risks, provides credible challenge, and helps develop effective mitigation strategies.

The position works with business leaders to understand cybersecurity posture, emerging cyber and AI-related risks, and strategic technology initiatives. It evaluates risk and control identification, assesses control coverage, monitors security portfolios and new technologies, reviews processes and controls, and advises on practical risk management approaches. It also assesses risks associated with new products, services, and third parties; supports audits and regulatory examinations; escalates significant risk issues; and monitors relevant industry and regulatory developments.

The role is based at 4910 Tiedeman Road, Brooklyn, Ohio. Key prioritizes in-office presence while providing flexible options when work can be performed effectively in a mobile environment. Occasional travel, including overnight stays, is required. The position is eligible for a base salary of $96,000 to $181,000 annually and incentive compensation, which may include production, commission, and/or discretionary incentives. Benefits eligibility is referenced in the posting, but specific benefits are not listed.

Requirements

• Bachelor’s degree in cybersecurity, information systems, computer science, business, or a related field, or a commensurate/relevant degree.
• At least 8 years of industry experience in Cybersecurity Risk, Information Security Risk, Technology Risk, or External/Internal Security Audit.
• Practical knowledge of cybersecurity domains such as security operations, cyber defenses, identity and access management, and network/cloud security architecture.
• Functional knowledge of AI/ML security risk concepts, such as AI governance, data security, and adversarial threats.
• Outstanding active listening skills and the ability to synthesize complex information or processes.
• Demonstrated ability to work with internal and external auditors and regulators.
• Ability to think strategically and independently drive execution to closure.
• Ability to view risk holistically in a dynamic, fast-paced team environment.
• In-depth practical knowledge of cybersecurity and technology controls, risk assessments, and techniques for implementing compliance and regulatory requirements.
• Ability to manage workflows and task assignments simultaneously and ensure timely completion of work.
• Execution-oriented mindset focused on process efficiency and continuous improvement.
• Intellectual curiosity and a passion for seeking to understand.
• Proven ability to establish and maintain strong industry contacts to stay informed about current industry issues and practices.
• Proficient PC skills, including experience with Microsoft Office, Outlook, and SharePoint.
• Ability to work with all levels of management, manage projects across functional areas and business partners, and contribute to initiatives requiring strategic planning.
• Flexibility to switch priorities in a fast-paced environment; ability to grasp complex processes quickly and identify risks and compensating controls.
• Excellent problem-solving skills, results orientation, and ability to make decisions independently.
• Ability to work as part of a team; strong leadership and influencing skills.
• Sound understanding of compliance and operational risks and internal control frameworks.
• Strong analytical and research skills, with the ability to summarize findings effectively.
• Excellent oral, written, and interpersonal communication skills; ability to adapt to change and communicate changing requirements.
• Excellent organizational skills, meticulous attention to detail, and self-motivation.
• Applicable certifications may include ISACA CISA, CRISC, CET, CGEIT, or CISM; ISC2 CISSP, CCSP, or SSCP; Cloud Security Alliance CCAK; or cloud-provider-specific certifications.

Nice To Haves

• Bachelor’s or master’s degree in a technology- or security-related field.
• Current and practical knowledge of technology and/or information security activities, challenges, and workflows.
• Additional industry certifications such as those listed in the posting.
• MBA, law degree, or other relevant advanced education.
• Foundational knowledge of Archer GRC.
• Project management or Agile experience.

Responsibilities

• Evaluate risk and control identification in key processes and perform gap assessments of control coverage and first-line identification processes.
• Collaborate with leaders and independently foster relationships to understand cybersecurity posture, emerging cyber and AI-related risks, and strategic technology initiatives, and identify risk-mitigation opportunities.
• Evaluate and monitor security portfolios, strategic initiatives, AI adoption and deployments, and emerging technologies for alignment with cyber risk appetite and business goals.
• Review cybersecurity processes, risks, and controls, and conduct targeted assessments to support effective oversight and compliance with enterprise risk management requirements.
• Provide expert advice on cybersecurity and AI risk management practices and practical solutions to mitigate identified risks.
• Analyze and assess cybersecurity and AI-related risks associated with new products or services, including third parties.
• Assist with cybersecurity and technology audits and regulatory examinations, ensuring thorough and timely responses to inquiries and findings.
• Escalate and report significant risk issues and facilitate appropriate corrective actions.
• Monitor emerging cyber and AI-related risks and industry and regulatory trends.

Benefits

• Eligible for incentive compensation, which may include production, commission, and/or discretionary incentives.
• Flexible workspace options in circumstances where roles can be performed effectively in a mobile environment.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior