Sr. Cybersecurity Operational Risk Officer

KeyBank•Brooklyn, OH

8d•$96,000 - $181,000•Hybrid

About The Position

This is a second-line-of-defense risk management role reporting to the Director of Cybersecurity Risk Oversight. The position provides independent oversight and risk management subject matter expertise to first-line business units and their corresponding Business Risk Teams. It is responsible for cybersecurity and information security risk oversight of the Key Technology Services line of business, as well as technology and information security risk oversight for enterprise areas that manage technology, data, and AI/ML systems. The role requires experience across cybersecurity domains, including security operations, network and cloud security architecture, identity and access management, and cyber defenses, as well as familiarity with emerging AI security risks and AI governance frameworks. The officer identifies material risks, provides credible challenge, and helps develop effective mitigation strategies. The position works with leaders, monitors technology and security initiatives, evaluates controls and risks, advises on risk management practices, and supports audits and regulatory examinations. The position is based at 4910 Tiedeman Road, Brooklyn, Ohio. Key prioritizes in-office presence while providing flexible options when work can be performed effectively in a mobile environment. Occasional travel, including overnight stays, is expected. The role is eligible for a base salary of $96,000 to $181,000 annually, with potential incentive compensation. Placement in the range may depend on skills, experience, and geographic location.

Requirements

Bachelor’s degree in cybersecurity, information systems, computer science, business, or a related field, or a commensurate/relevant degree.
At least 8 years of industry experience in cybersecurity risk, information security risk, technology risk, or external/internal security audit.
Practical knowledge of cybersecurity domains such as security operations, cyber defenses, identity and access management, and network/cloud security architecture.
Functional knowledge of AI/ML security risk concepts, including AI governance, data security, and adversarial threats.
Outstanding active listening skills and ability to synthesize complex information or processes.
Demonstrated ability to work with internal and external auditors and regulators.
Strategic thinking and ability to independently drive execution to completion.
Ability to assess risk holistically in a dynamic, fast-paced team environment.
In-depth practical knowledge of cybersecurity and technology controls, risk assessments, and techniques for implementing compliance and regulatory requirements.
Ability to manage workflows and task assignments simultaneously and complete work on time.
Execution-oriented mindset focused on process efficiency and continuous improvement.
Intellectual curiosity and a desire to understand.
Ability to establish and maintain industry contacts and stay aware of current industry issues and practices.
Demonstrated experience working with regulatory agencies, guidelines, and requirements.
Ability to work with all levels of management and across multiple functional areas and business partners.
Experience working on projects and initiatives requiring strategic planning or thinking.
Flexibility to shift priorities in a fast-paced environment.
Ability to quickly understand complex processes and identify risks and compensating controls.
Strong problem-solving skills; results-oriented and able to make decisions independently.
Ability to work as part of a team, demonstrate leadership, and influence others.
Sound understanding of compliance and operational risks and internal control frameworks.
Strong analytical and research skills and ability to summarize findings effectively.
Excellent oral, written, and interpersonal communication skills.
Ability to adapt to change and communicate changing requirements.
Excellent organizational skills and attention to detail; self-motivated.
Proficient PC skills, including Microsoft Office, Outlook, and SharePoint.
Applicable certifications may include ISACA CISA, CRISC, CET, CGEIT, or CISM; ISC2 CISSP, CCSP, or SSCP; Cloud Security Alliance CCAK; or cloud provider-specific certifications.
Ability to meet the role’s physical demands, including prolonged sitting, face-to-face or phone communication, frequent PC/laptop use, and occasional lifting, pushing, or pulling of computer or backpack bags up to 10 pounds.
Occasional travel, including overnight stays.

Nice To Haves

Bachelor’s or master’s degree in a technology- or security-related field.
Current practical knowledge of technology and/or information security activities, challenges, and workflows.
Additional relevant industry certifications.
MBA, law degree, or other relevant advanced education.
Foundational knowledge of Archer GRC.
Project management or Agile experience.

Responsibilities

Evaluate risk and control identification within key processes and assess gaps in control coverage and first-line risk identification processes.
Build relationships with leaders to understand cybersecurity posture, emerging cyber and AI-related risks, and strategic technology initiatives, and identify opportunities to mitigate risk.
Evaluate and monitor security portfolios, strategic initiatives, AI adoption and deployments, and emerging technologies for alignment with cyber risk appetite and business goals.
Review cybersecurity processes, risks, and controls, and conduct targeted assessments to support oversight and enterprise risk management requirements.
Provide expert advice and practical solutions for cybersecurity and AI risk management.
Assess cybersecurity and AI-related risks associated with new products and services, including third parties.
Assist with cybersecurity and technology audits and regulatory examinations, and provide timely responses to inquiries and findings.
Escalate significant risk issues and facilitate appropriate corrective actions.
Monitor emerging cyber and AI-related risks, industry trends, and regulatory developments.
Manage workflows and concurrent task assignments to ensure timely completion of work.
Support process efficiency and continuous improvement.