IT Risk & Control Director - Cybersecurity

Huntington National Bank•Detroit, MI

18d•$125,000 - $255,000•Onsite

About The Position

The Technology Risk & Control Director – Cybersecurity is a senior front-line Technology Risk leader who provides risk insight, advisory support, and constructive challenge across cybersecurity and information protection domains. The role partners with Cybersecurity and Technology leaders who own standards, procedures, controls, metrics, and operational practices. It helps those leaders understand risk exposure, evaluate the effectiveness and sustainability of controls, identify emerging or systemic risk themes, and make informed risk decisions, without taking ownership of control execution or remediation. The position provides risk expertise across Identity and Access Management (IAM), Privileged Access Management (PAM), Data Protection, Cloud Security, Vulnerability and Exposure Management, Application Security, Security Architecture, Cybersecurity Operations, and other evolving cybersecurity areas. The leader translates complex technical conditions into business risk, control implications, risk trends, and clear executive insights; contributes to executive, management, Board, and regulatory materials; and leads and develops a high-performing Technology Risk team.

Requirements

Bachelor's degree or equivalent level of work experience.
10+ years in a related role.
Strong cybersecurity and technology risk experience, sound judgment, and the ability to translate complex technical conditions into business risk, control implications, risk trends, and executive insights.
Significant experience in a first-line technology risk, cybersecurity risk, information security risk, or comparable risk and control function in a financial institution or other highly regulated organization.
Demonstrated knowledge across multiple cybersecurity disciplines, particularly IAM/PAM, Data Protection, Cloud Security, Vulnerability Management, cybersecurity controls, or related domains.
Experience operating within the three lines model and partnering with Technology/Cybersecurity control owners, Independent Risk, Compliance, Internal Audit, and regulatory stakeholders.
Experience advising senior leaders on cybersecurity and technology risks without assuming responsibility for underlying operational processes or controls.
Ability to translate cybersecurity conditions into business risk, control implications, residual risk considerations, risk trends, and decision-oriented executive insights.
Experience leading senior professionals and developing risk talent within complex, matrixed organizations.
Deep understanding of IAM and PAM, including identity governance, authentication, authorization, MFA, privileged access, entitlement management, access certification, service/non-human identities, and identity lifecycle management.
Strong understanding of Data Protection, including sensitive data protection, encryption, key management, DLP, sensitive-information access, and information lifecycle considerations.
Strong understanding of Cloud Security, including identity and access, workload protection, infrastructure security, configuration, encryption, secrets management, and cloud governance.
Strong understanding of Vulnerability and Exposure Management, Application Security, Security Architecture, endpoint and network security, Cybersecurity Operations, and incident-related risk.
Working knowledge of cybersecurity frameworks and practices such as NIST Cybersecurity Framework, NIST SP 800-53, NIST Zero Trust guidance, CIS Controls, and ISO/IEC 27001.
Experience assessing risk in major public-cloud environments such as Microsoft Azure, AWS, or GCP.
Experience with risk assessments, RCSAs/control assessments, issue management, risk acceptance, remediation governance, control testing results, KRIs, audit engagement, and regulatory examinations.
Ability to identify systemic and aggregate risk themes across cybersecurity findings, metrics, control deficiencies, risk acceptances, exceptions, and other risk indicators.
Strong executive presence and ability to communicate cybersecurity risk to senior management, Board-level audiences, regulators, Independent Risk, and Internal Audit.
Ability to provide constructive and credible challenge while maintaining collaborative relationships and clear ownership boundaries.
Strong written and verbal communication skills, including the ability to turn complex cybersecurity concepts into concise, business-oriented risk insights and recommendations.

Nice To Haves

Relevant professional certifications such as CISSP, CISM, CRISC, CISA, CCSP, or comparable cybersecurity/risk credentials.

Responsibilities

Serve as a senior Technology Risk partner to Cybersecurity and Technology leadership, providing risk insight, advice, and constructive challenge across cybersecurity and information protection domains.
Build collaborative relationships with Cybersecurity, Technology, Data, business-aligned technology teams, Independent Risk, Compliance, Legal, Privacy, Audit, and other enterprise stakeholders.
Provide risk insight across IAM, PAM, authentication and authorization, identity governance, Data Protection, Cloud Security, Vulnerability and Exposure Management, Application Security, Security Architecture, Cyber Operations, endpoint and network security, and cyber incident risk.
Partner with control owners to assess risks involving identity lifecycle management, privileged access, excessive or unauthorized access, service and non-human identities, entitlements, authentication, access certification, and segregation of duties.
Advise on cloud-adoption and cloud-native technology risks, including identity, privileged access, sensitive data, security configuration, workload protection, encryption, secrets management, and monitoring.
Provide independent risk perspectives on data security and protection practices, including encryption, key management, DLP, sensitive-data access, and information lifecycle controls.
Help interpret vulnerability and exposure information and translate technical conditions into potential business impact, risk concentration, prioritization considerations, and executive-level insight.
Provide risk input into standards, procedures, metrics, KRIs, risk assessments, control assessments, risk acceptances, exceptions, issues, and remediation strategies while preserving accountability with the appropriate owner.
Analyze cybersecurity risks across domains to identify common themes, systemic conditions, risk concentrations, control dependencies, and emerging risks.
Help ensure cybersecurity findings, control deficiencies, exceptions, and other risk indicators are appropriately represented in the broader Technology Risk profile.
Partner with issue and control owners on root-cause analysis, risk articulation, remediation strategies, risk acceptance, and closure considerations without assuming ownership for remediation or control execution.
Provide risk insight into cybersecurity metrics, KRIs, and risk appetite measures, distinguishing indicators of actual risk exposure from operational performance, program delivery, or activity measures.
Translate cybersecurity conditions into potential business impact, including unauthorized access, data compromise, fraud or unauthorized money movement, service disruption, customer impact, financial loss, and regulatory exposure, where applicable.
Prepare and contribute to executive-level risk assessments, management and Board reporting, regulatory responses, issue updates, and decision materials.
Participate in Cybersecurity and Technology governance forums, bringing forward risk trends, emerging concerns, cross-domain dependencies, and areas requiring leadership attention or decisions.
Maintain clear role boundaries within the three lines model, supporting Technology and Cybersecurity ownership while providing first-line Technology Risk insight and challenge and supporting engagement with Independent Risk and Internal Audit.
Monitor developments in cyber threats, technology architecture, regulation, industry practices, cloud technologies, identity, data protection, and emerging technologies.
Lead and develop a high-performing Technology Risk team with cybersecurity expertise, business acumen, collaborative partnership, sound judgment, and the ability to provide actionable risk insights.
Perform other duties as assigned.