US Region Cybersecurity Platform Service Governance Owner

CIBC•Chicago, IL

22d•$170,000 - $195,000•Hybrid

About The Position

As a member of CIBC’s US Security Services team, this role operates in a fast-paced information security environment focused on protecting the bank from cyber threats and strengthening the U.S. region’s security, risk, and compliance posture. The role leads governance, management, and execution of cybersecurity platform services across the U.S. region, with accountability for application, cloud, endpoint, and network security capabilities. The position establishes the service vision and strategy and oversees the roadmap, prioritization, and feature development needed to maintain effective, resilient, and business-aligned security services. It provides governance oversight to support cybersecurity, risk management, compliance, and control objectives, ensuring alignment with enterprise security standards, regulatory requirements, risk frameworks, control expectations, and audit requirements. The role also reviews AI-related capabilities, use cases, and initiatives and makes recommendations that support appropriate governance, secure design, regulatory compliance, risk mitigation, and responsible implementation. The position works in a hybrid environment, with three days in the office and two days remote. The expected salary range for the Chicago market is $170,000–$195,000, based on experience, qualifications, and location. The successful candidate may be eligible for incentive compensation, including a discretionary bonus component.

Requirements

Demonstrated experience in cybersecurity, information security, technology risk, or security service management.
Experience providing governance or oversight in one or more of application, cloud, endpoint, or network security.
Strong understanding of risk management, control frameworks, regulatory expectations, audit processes, and compliance requirements.
Experience defining or managing service strategies, roadmaps, prioritization, and operational governance.
Ability to work effectively across a complex organization and influence stakeholders across technology, risk, compliance, and business teams.
Strong written and verbal communication skills, including the ability to present clearly to technical and non-technical stakeholders.
Proven ability to manage competing priorities in a fast-paced environment.
Strong knowledge of cybersecurity governance and service management practices.
Ability to translate business, regulatory, and risk requirements into practical service priorities and governance actions.
Knowledge of security controls, technology risk management, and operational resilience concepts.
Strong stakeholder management and partnership skills.
Ability to develop, track, and report KPIs, KRIs, SLAs, and control effectiveness measures.
Strong analytical, problem-solving, and decision-making skills.
Ability to identify risks, escalate issues appropriately, and drive resolution through partnership and governance.
Must be legally eligible to work at the specified location and, where applicable, hold a valid work or study permit.

Nice To Haves

Experience in financial services or another highly regulated environment.
Familiarity with U.S. regulatory expectations relevant to cybersecurity and technology risk.
Experience with Enterprise Security Services, shared service models, or third-party security service providers.
Understanding of emerging technology, including AI governance, emerging AI risk considerations, and responsible technology adoption practices.
Experience supporting audit readiness, issue remediation, and control maturity improvement initiatives.

Responsibilities

Provide governance oversight for U.S. Region cybersecurity platform services across application, cloud, endpoint, and network security.
Ensure services align with enterprise governance standards, regulatory obligations, risk management frameworks, control requirements, and audit expectations.
Drive service accountability, control oversight, and operational discipline across the cybersecurity platform portfolio.
Support audit readiness, regulatory reviews, issue remediation, and continuous improvement in control effectiveness.
Promote consistent, transparent, and risk-informed governance practices across supported services.
Define and maintain the service vision, strategy, and roadmap for U.S. Region cybersecurity platform services.
Align roadmap priorities with business needs, security objectives, regulatory expectations, and enterprise direction.
Oversee feature development and capability enhancements to keep services effective, resilient, and responsive to evolving threats.
Represent customers and stakeholders by incorporating feedback into service planning, prioritization, and continuous improvement.
Maintain visibility into service performance, maturity, dependencies, and strategic opportunities across the portfolio.
Govern prioritization and decision-making for service enhancements, control improvements, and operational requirements.
Establish accountability for service ownership, governance routines, metrics, and escalation paths.
Develop and report service metrics, KPIs, risk indicators, and control effectiveness measures.
Maintain service documentation, governance artifacts, and service catalog information as required.
Collaborate with U.S. and enterprise security service owners, technology teams, risk and compliance partners, and business stakeholders.
Influence enterprise roadmaps and service strategies to support U.S. Region priorities and regulatory needs.
Participate in enterprise planning and ensure services provided to the U.S. region have appropriate governance, clarity, and accountability.
Coordinate stakeholders on service transitions, enhancements, and issue resolution.
Govern services delivered through Enterprise Security Services or third parties and ensure alignment with U.S. Region requirements.
Ensure RACI, service expectations, and performance measures are defined, monitored, and reviewed regularly.
Support adherence to applicable U.S. regulatory requirements, including oversight of Reg W considerations where relevant.
Follow Third Party Risk Management processes and best practices for third-party governance, contract renewals, and ongoing service accountability.
Review AI-related capabilities, use cases, and initiatives within the cybersecurity platform service portfolio.
Recommend appropriate governance, secure adoption, risk mitigation, regulatory compliance, and responsible implementation of AI-related solutions.
Assess AI-, quantum-, and other emerging-technology proposals for risk, control, compliance, and operational effectiveness.
Partner with enterprise stakeholders to align emerging technology activities with internal governance standards and evolving regulatory expectations.