Sr. Director, Tech Risk & Analysis

Capital One • McLean, VA

2d

About The Position

Capital One is seeking a senior technology risk professional to lead work within its Information Security Office and cybersecurity Governance and Risk team. The role leads a team coordinating and executing audit, regulatory, and executive engagements, and partners with technical teams to manage and improve end-to-end processes using Capital One’s SLQ2CQ management framework, based on Lean Enterprise and Six Sigma. The position works across functions and organizational levels to advance cybersecurity governance, resilience, and risk transformation.

The role applies cybersecurity best practices to assess current state, identify gaps, evaluate cyber risk and threats, and determine business impact. It defines and prioritizes mitigation strategies, escalates recommendations, and participates in the design and implementation of cyber control programs. The position also serves as a cybersecurity subject-matter expert in risk frameworks, information security risk assessments and controls, regulatory and internal governance, data analysis, metrics and reporting, and customer engagement.

The successful candidate is a disciplined, collaborative leader who can independently direct work, influence partners, communicate effectively, analyze complex information, adapt to change, and motivate others. The role involves using reporting and analysis tools to inform policy and drive change; it does not require building those tools. Coding may be used for analysis or automation but is not a baseline requirement. The position reports cyber-related risks to Accountable Executives through relevant risk forums and established processes.

Requirements

• At least 12 years of experience in one or more of the following areas, or a combination: technology (including software delivery, distributed systems, cloud-native architecture, or infrastructure as code); cybersecurity (including identity and access management, application security, cloud security, or data protection); technology auditing; systems risk management; technology risk assessments; resilience engineering; chaos engineering; or site reliability engineering.
• Strong leadership and communication skills, attention to detail, analytical skills, adaptability, and self-motivation.
• Ability to manage and direct work independently while influencing partners across the company and organizational levels.
• Ability to assess cybersecurity risk, analyze data, prioritize vulnerabilities and risks, and escalate appropriately.

Nice To Haves

• Bachelor’s degree in Information Technology, Cybersecurity, or equivalent.
• 14 or more years of risk management experience in a cyber or information security practice.
• 12 or more years of experience in cloud computing, such as AWS, GCP, or Azure.
• 12 or more years of experience in a second-line or oversight role at a financial institution or regulatory agency.
• Professional security certification or professional risk management certification.
• Certified Information Systems Security Professional (CISSP).
• Certified Information Systems Auditor (CISA).
• Certified in Risk and Information Systems Control (CRISC).
• Open FAIR Certified.
• Experience using code to perform or automate analysis and repeatable tasks.

Responsibilities

• Lead a team coordinating and executing audit, regulatory, and executive engagements.
• Partner with technical teams to manage and improve processes from beginning to end using the SLQ2CQ management framework.
• Assess current state, identify cybersecurity gaps, and evaluate cyber risks, threats, and business impact.
• Define mitigation strategies, prioritize recommendations, and escalate risks as appropriate.
• Participate in the design and implementation of cyber control programs.
• Analyze data, reporting metrics, vulnerabilities, and potential risks to distinguish critical, high-risk, and low-risk issues.
• Use reporting and tools to analyze projects, efforts, or datasets and inform policies and change.
• Research and evaluate industry practices and regulatory changes affecting cybersecurity policies or programs, and recommend practical solutions.
• Recommend changes to policies, procedures, and control programs to mitigate evolving risks.
• Challenge cyber control programs as part of first-line duties and escalate risks where appropriate.
• Manage program lifecycles, documenting and communicating action plans, impediments, risks, and stakeholder engagement.
• Review and report on vulnerability assessments to confirm functionality and alignment with Information Security Standards.
• Advise Accountable Executives of cyber-related risk through risk forums and established processes such as exception and issue management.
• Monitor the evolving cyber threat landscape to maintain relevant risk mitigation.
• Lead and work with cross-functional teams in the Information Security Office.

Benefits

• Comprehensive health, financial, and other benefits supporting total well-being.
• Eligibility for performance-based incentive compensation, which may include cash bonuses and/or long-term incentives.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed