Sr. Director, Tech Risk & Analysis

Capital One • McLean, VA

3d • $245,100 - $307,700

About The Position

Capital One is seeking a technology risk and analysis professional to lead work within its cybersecurity Governance and Risk team. The role coordinates and executes audit, regulatory, and executive engagements, partnering with technical teams to manage and improve end-to-end processes using the company’s SLQ2CQ management framework, based on Lean Enterprise and Six Sigma. As part of the Information Security Office, the position leads cross-functional teams and contributes to cybersecurity governance, resilience, and risk transformation.

The role applies cyber best practices to assess current states, identify gaps, evaluate cyber risks and threats, and determine business impact. It develops mitigation strategies, prioritizes and escalates recommendations, participates in cyber control program design and implementation, and serves as a subject matter expert in risk frameworks, information security risk assessments and controls, governance, data analysis, reporting, and customer engagement. The position uses reporting and analysis tools to inform policy and change, advises accountable executives through risk forums and established processes, and keeps mitigation approaches current with the evolving cyber threat landscape.

Requirements

• At least 12 years of experience in technology, cybersecurity, technology auditing, systems risk management, technology risk assessments, resilience engineering, chaos engineering, site reliability engineering, or a combination of these areas.
• Broad understanding of technology systems, including networks, applications, cloud computing, and data.
• Broad understanding of operating systems and their vulnerabilities, and ability to recognize and assess risk beyond simply using tools and reports.
• Broad understanding of major categories of cyber threats, how they may occur in the environment, and measures required to safeguard the enterprise.
• Ability to analyze data, assess risk, prioritize vulnerabilities, and communicate or escalate findings accurately.
• Ability to research cybersecurity practices and regulatory changes and recommend practical solutions.
• Ability to manage program lifecycles, communicate risks and action plans, and engage stakeholders.
• Strong leadership, communication, analytical, and attention-to-detail skills; ability to adapt to change, work independently, and influence partners across organizational levels.
• Ability to work effectively in a team environment and motivate others.

Nice To Haves

• Bachelor’s degree in Information Technology, Cybersecurity, or equivalent.
• 14 or more years of risk management experience in a Cyber or Information Security practice.
• 12 or more years of experience in cloud computing, such as AWS, GCP, or Azure.
• 12 or more years of experience in a second-line or oversight role at a financial institution or regulatory agency.
• Professional Security Certification or Professional Risk Management Certification.
• Certified Information Systems Security Professional (CISSP).
• Certified Information Systems Auditor (CISA).
• Certified in Risk and Information Systems Control (CRISC).
• Open FAIR Certified.
• Experience with coding for analysis or automation of repeatable tasks; coding is not a baseline requirement.

Responsibilities

• Coordinate and execute audit, regulatory, and executive engagements with the cybersecurity Governance and Risk team.
• Lead cross-functional teams and work with technical partners to manage and improve end-to-end processes.
• Assess current state, identify gaps, and evaluate cyber risks, threats, and business impact.
• Define mitigation strategies, prioritize recommendations, and escalate risks as appropriate.
• Participate in the design and implementation of cyber control programs.
• Analyze reports, tools, datasets, and metrics to inform policies, drive change, and communicate cyber risk; use tools such as Excel or Google Sheets to analyze data and create charts.
• Analyze vulnerabilities and potential risks, prioritize them by severity, and escalate critical or high-risk issues as appropriate.
• Research industry practices and regulatory changes affecting cybersecurity policies or programs, and recommend practical solutions.
• Recommend changes to policies, procedures, and control programs to mitigate evolving risks.
• Challenge cyber control programs as part of first-line duties and escalate risks where appropriate.
• Manage program lifecycles, including documenting and communicating action plans, impediments, risks, and stakeholder engagement.
• Report on vulnerability assessments and explain whether they function properly and align with Information Security Standards; resolving the findings is not required.
• Advise Accountable Executives about cyber-related risks through relevant risk forums and existing processes such as exception and issue management.
• Keep pace with the evolving cyber threat landscape to maintain relevant cyber risk mitigation.

Benefits

• Comprehensive, competitive, and inclusive health, financial, and other benefits supporting total well-being.
• Eligible for performance-based incentive compensation, which may include cash bonuses and/or long-term incentives.

What This Job Offers

• Job Type: Full-time
• Career Level: Director
• Education Level: No Education Listed