Director, Cybersecurity Operations & Risk Governance
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). We need to include sections only when posting has real specific content. We have content for: Position Summary (could be About the role). Responsibilities (multiple bullet points). Qualifications (Required and Preferred). Benefits (explicit). Pay (expected range). Schedule? Not mentioned. So we should not include Schedule. Also maybe Skills? Not explicit separate; qualifications cover skills. Could include Skills if present but not needed.
We need to preserve all substantive info, not invent. Remove boilerplate: EEO, accommodation, privacy, etc. Also remove duplicated lines. Also remove application instructions (none). Also remove cookie/navigation/legal.
We need to format: Use for headings. Use - for any list of duties/requirements/benefits. Use
for prose.
We need to include Position Summary as maybe About the role. Could also have a short paragraph about Harris culture as part of About the role? The instruction: do NOT repeat the job title as a heading. The page already shows it. So we can start with About the role heading and include the Position Summary paragraph plus maybe the Harris culture intro? The intro about Harris values could be considered "About the company" but not required. We could include it under About the role as prose.
Let's extract:
Intro paragraph: "At Harris, the true value of what makes us successful is found in our people. It is our unique mix of cultures, experiences, beliefs and backgrounds that sets Harris apart from the rest. We constantly strive to cultivate, nurture and amplify an unparalleled environment, where we value intellectual curiosity and uniqueness of thought. Inclusion is embedded in the very fabric of our culture of collaboration and openness. We understand that a job description only tells one part of a broader story, and Harris is seeking dynamic candidates who can add to our best-in-class environment. We recognize that qualifications can be gained through both traditional and non-traditional paths, and we are committed to considering candidates who possess the potential to be excellent in this role regardless of prior experiences. Therefore we encourage ALL interested individuals to submit their applications, even if they do not meet every requirement outlined in the job description."
That's substantive; we can include under About the role.
Then Position Summary: "The Cybersecurity team protects Harris Associates’ information assets and technology environment through security operations (detection, response, and vulnerability management) and cybersecurity risk governance (regulatory compliance, enterprise risk, third-party risk, and board reporting), reporting to the Chief Information Security Officer (CISO). The Director, Cybersecurity Operations & Risk Governance serves as the CISO’s principal deputy, running the firm’s Security Operations Center while owning the cybersecurity risk register, control framework mapping (NIST CSF, NIST AI RMF), and the firm’s obligations under the SEC Cybersecurity Rule, Regulation S-P, GLBA, and FINRA. This individual represents cybersecurity risk posture to committees and Internal Audit, acts as the CISO’s proxy when delegated, and directly leads and mentors a small, growing team of security analysts/engineers (currently 1–2 direct reports) - staying hands-on in daily operations while directing incident response, defending risk decisions to a committee, and briefing examiners or institutional clients as needed."
We can combine with About the role or separate. Probably better to have About the role include the intro and position summary.
Then Responsibilities: list bullet points under headings: Security Operations Leadership, Cybersecurity Risk Governance, Leadership and Program Management. Each has sub-bullets. We'll need to output
- for any list. Could nest? Probably just flat list items; but we can include sub-bullets as separate
- with dash? The instruction: use
- for any list of duties/requirements/benefits. So we can create a
with each responsibility as - . For sub-items we could embed them within the same
- using semicolons or separate
inside? Not prohibited but safer to keep flat.
We'll extract each bullet:
Security Operations Leadership:
- Own and mature the firm’s security operations function — monitoring, detection, and triage across XDR, DLP, and endpoint controls — in partnership with any MDR/MSSP provider.
- Serve as Incident Commander for cybersecurity incidents: direct containment, eradication, and recovery; own the incident response plan, playbooks, and tabletop exercises; lead post-incident reviews.
- Own the vulnerability management program end to end, including risk-based prioritization, remediation SLAs, and recurring reporting to IT leadership and the CISO.
- Direct third-party red team, penetration testing, and PAM initiatives; maintain threat intelligence relevant to the sector; and coordinate with Security Engineering/Infrastructure on architecture implications of findings.
Cybersecurity Risk Governance:
- Own the enterprise cybersecurity risk register and risk-scoring methodology, mapped to the NIST Cybersecurity Framework (CSF) and, where applicable, the NIST AI Risk Management Framework (AI RMF).
- Prepare and present cybersecurity metrics, key risk indicators (KRIs), and program updates to the CISO and TDS Leadership.
- Own the third-party/vendor cybersecurity risk program, the lifecycle of cybersecurity policies and standards, and the cybersecurity risk dimension of the firm’s AI governance program.
- Serve as the firm’s principal point of contact for cybersecurity regulatory and client due diligence obligations — SEC Cybersecurity Rule, Regulation S-P, GLBA, FINRA, Natixis-affiliate reporting, and institutional DDQs/RFPs - partnering with Legal, Compliance, and Internal Audit as needed.
Leadership and Program Management:
- Directly manage and mentor a small team of security analysts/engineers, working alongside them on investigations, remediation, and governance tasks; grow their skills and build a bench that covers both operational and governance workstreams as the team scales.
- Act as the CISO’s deputy and, where delegated, proxy in meetings, audit engagements, examiner interviews, and client-facing discussions.
- Own budget input, vendor/tooling recommendations, and the dashboards and reporting cadence used for Board, DPCC, and executive visibility; perform other duties as assigned by the CISO.
Qualifications Required:
- Bachelor’s degree in Information Security, Computer Science, or a related field, or equivalent practical experience.
- 8–10 years of progressive cybersecurity experience, including 3–5 years in a leadership or program-ownership role spanning both security operations and risk governance.
- Demonstrated experience operating a SOC/detection function using enterprise SIEM/XDR tooling (Microsoft Sentinel and Defender XDR strongly preferred) and building a cybersecurity risk governance program (risk registers, NIST CSF mapping, recurring board-level reporting), with direct incident command experience.
- Direct experience in a regulated financial services environment, with working knowledge of the SEC Cybersecurity Rule, Regulation S-P, GLBA, and FINRA; a demonstrated track record as a hands-on mentor who has grown analysts into senior contributors, even within a small team; and CISSP required (or in progress with a 12-month commitment).
Preferred:
- Experience in asset/investment management, and familiarity with the Microsoft E5 security stack (Defender XDR, Sentinel, Purview, Entra ID, Intune) and/or PAM/EDR controls (e.g., ThreatLocker).
- Additional certifications (CISM, CRISC, GSEC, GCIH, or CCSP), exposure to AI governance frameworks (e.g., NIST AI RMF), or experience supporting institutional DDQ/RFP processes and affiliate/parent-company reporting (e.g., Natixis).
Special requirements:
- Given Incident Commander responsibilities, this role requires availability to respond to cybersecurity incidents outside of normal business hours, including nights and weekends, with occasional travel to support regulatory exams or client due diligence.
Benefits:
- medical, prescription drug, dental and vision insurance, paid time off, profit sharing plan, 401k plan, tuition reimbursement, commuter and holistic wellness benefits along with volunteer programs.
Pay:
- Expected range for this Chicago-based role $180,000 - $200,000 USD
- Also note: Actual annual base salaries may vary based on factors... If hired, base pay will be determined on an individualized basis... We could include that as prose under Pay.
We should not include filler like "commensurate with experience". The posting includes "Actual annual base salaries may vary based on factors including but not limited to education, training, experience, and other job-related factors. If hired, base pay will be determined on an individualized basis and is only one part of the total compensation package, which, depending on the position, may also include a discretionary performance bonus and other Harris sponsored benefit programs." That's substantive; we can include under Pay as prose.
Schedule: not present, so omit.
We need to output only HTML fragment, no markdown fences.
Let's craft:
About the role
At Harris, the true value of what makes us successful is found in our people. It is our unique mix of cultures, experiences, beliefs and backgrounds that sets Harris apart from the rest. We constantly strive to cultivate, nurture and amplify an unparalleled environment, where we value intellectual curiosity and uniqueness of thought. Inclusion is embedded in the very fabric of our culture of collaboration and openness. We understand that a job description only tells one part of a broader story, and Harris is seeking dynamic candidates who can add to our best-in-class environment. We recognize that qualifications can be gained through both traditional and non-traditional paths, and we are committed to considering candidates who possess the potential to be excellent in this role regardless of prior experiences. Therefore we encourage ALL interested individuals to submit their applications, even if they do not meet every requirement outlined in the job description.
The Cybersecurity team protects Harris Associates’ information assets and technology environment through security operations (detection, response, and vulnerability management) and cybersecurity risk governance (regulatory compliance, enterprise risk, third-party risk, and board reporting), reporting to the Chief Information Security Officer (CISO). The Director, Cybersecurity Operations & Risk Governance serves as the CISO’s principal deputy, running the firm’s Security Operations Center while owning the cybersecurity risk register, control framework mapping (NIST CSF, NIST AI RMF), and the firm’s obligations under the SEC Cybersecurity Rule, Regulation S-P, GLBA, and FINRA. This individual represents cybersecurity risk posture to committees and Internal Audit, acts as the CISO’s proxy when delegated, and directly leads and mentors a small, growing team of security analysts/engineers (currently 1–2 direct reports) - staying hands-on in daily operations while directing incident response, defending risk decisions to a committee, and briefing examiners or institutional clients as needed.
Responsibilities
- Own and mature the firm’s security operations function — monitoring, detection, and triage across XDR, DLP, and endpoint controls — in partnership with any MDR/MSSP provider.
- Serve as Incident Commander for cybersecurity incidents: direct containment, eradication, and recovery; own the incident response plan, playbooks, and tabletop exercises; lead post-incident reviews.
- Own the vulnerability management program end to end, including risk-based prioritization, remediation SLAs, and recurring reporting to IT leadership and the CISO.
- Direct third-party red team, penetration testing, and PAM initiatives; maintain threat intelligence relevant to the sector; and coordinate with Security Engineering/Infrastructure on architecture implications of findings.
- Own the enterprise cybersecurity risk register and risk-scoring methodology, mapped to the NIST Cybersecurity Framework (CSF) and, where applicable, the NIST AI Risk Management Framework (AI RMF).
- Prepare and present cybersecurity metrics, key risk indicators (KRIs), and program updates to the CISO and
- for any list of duties/requirements/benefits. Use
for prose. We need to include Position Summary as maybe About the role. Could also have a short paragraph about Harris culture as part of About the role? The instruction: do NOT repeat the job title as a heading. The page already shows it. So we can start with About the role heading and include the Position Summary paragraph plus maybe the Harris culture intro? The intro about Harris values could be considered "About the company" but not required. We could include it under About the role as prose. Let's extract: Intro paragraph: "At Harris, the true value of what makes us successful is found in our people. It is our unique mix of cultures, experiences, beliefs and backgrounds that sets Harris apart from the rest. We constantly strive to cultivate, nurture and amplify an unparalleled environment, where we value intellectual curiosity and uniqueness of thought. Inclusion is embedded in the very fabric of our culture of collaboration and openness. We understand that a job description only tells one part of a broader story, and Harris is seeking dynamic candidates who can add to our best-in-class environment. We recognize that qualifications can be gained through both traditional and non-traditional paths, and we are committed to considering candidates who possess the potential to be excellent in this role regardless of prior experiences. Therefore we encourage ALL interested individuals to submit their applications, even if they do not meet every requirement outlined in the job description." That's substantive; we can include under About the role. Then Position Summary: "The Cybersecurity team protects Harris Associates’ information assets and technology environment through security operations (detection, response, and vulnerability management) and cybersecurity risk governance (regulatory compliance, enterprise risk, third-party risk, and board reporting), reporting to the Chief Information Security Officer (CISO). The Director, Cybersecurity Operations & Risk Governance serves as the CISO’s principal deputy, running the firm’s Security Operations Center while owning the cybersecurity risk register, control framework mapping (NIST CSF, NIST AI RMF), and the firm’s obligations under the SEC Cybersecurity Rule, Regulation S-P, GLBA, and FINRA. This individual represents cybersecurity risk posture to committees and Internal Audit, acts as the CISO’s proxy when delegated, and directly leads and mentors a small, growing team of security analysts/engineers (currently 1–2 direct reports) - staying hands-on in daily operations while directing incident response, defending risk decisions to a committee, and briefing examiners or institutional clients as needed." We can combine with About the role or separate. Probably better to have About the role include the intro and position summary. Then Responsibilities: list bullet points under headings: Security Operations Leadership, Cybersecurity Risk Governance, Leadership and Program Management. Each has sub-bullets. We'll need to output
- for any list. Could nest? Probably just flat list items; but we can include sub-bullets as separate
- with dash? The instruction: use
- for any list of duties/requirements/benefits. So we can create a
- with each responsibility as
- . For sub-items we could embed them within the same
- using semicolons or separate
- inside? Not prohibited but safer to keep flat.
We'll extract each bullet:
Security Operations Leadership:
- Own and mature the firm’s security operations function — monitoring, detection, and triage across XDR, DLP, and endpoint controls — in partnership with any MDR/MSSP provider.
- Serve as Incident Commander for cybersecurity incidents: direct containment, eradication, and recovery; own the incident response plan, playbooks, and tabletop exercises; lead post-incident reviews.
- Own the vulnerability management program end to end, including risk-based prioritization, remediation SLAs, and recurring reporting to IT leadership and the CISO.
- Direct third-party red team, penetration testing, and PAM initiatives; maintain threat intelligence relevant to the sector; and coordinate with Security Engineering/Infrastructure on architecture implications of findings.
Cybersecurity Risk Governance:
- Own the enterprise cybersecurity risk register and risk-scoring methodology, mapped to the NIST Cybersecurity Framework (CSF) and, where applicable, the NIST AI Risk Management Framework (AI RMF).
- Prepare and present cybersecurity metrics, key risk indicators (KRIs), and program updates to the CISO and TDS Leadership.
- Own the third-party/vendor cybersecurity risk program, the lifecycle of cybersecurity policies and standards, and the cybersecurity risk dimension of the firm’s AI governance program.
- Serve as the firm’s principal point of contact for cybersecurity regulatory and client due diligence obligations — SEC Cybersecurity Rule, Regulation S-P, GLBA, FINRA, Natixis-affiliate reporting, and institutional DDQs/RFPs - partnering with Legal, Compliance, and Internal Audit as needed.
Leadership and Program Management:
- Directly manage and mentor a small team of security analysts/engineers, working alongside them on investigations, remediation, and governance tasks; grow their skills and build a bench that covers both operational and governance workstreams as the team scales.
- Act as the CISO’s deputy and, where delegated, proxy in meetings, audit engagements, examiner interviews, and client-facing discussions.
- Own budget input, vendor/tooling recommendations, and the dashboards and reporting cadence used for Board, DPCC, and executive visibility; perform other duties as assigned by the CISO.
Qualifications Required:
- Bachelor’s degree in Information Security, Computer Science, or a related field, or equivalent practical experience.
- 8–10 years of progressive cybersecurity experience, including 3–5 years in a leadership or program-ownership role spanning both security operations and risk governance.
- Demonstrated experience operating a SOC/detection function using enterprise SIEM/XDR tooling (Microsoft Sentinel and Defender XDR strongly preferred) and building a cybersecurity risk governance program (risk registers, NIST CSF mapping, recurring board-level reporting), with direct incident command experience.
- Direct experience in a regulated financial services environment, with working knowledge of the SEC Cybersecurity Rule, Regulation S-P, GLBA, and FINRA; a demonstrated track record as a hands-on mentor who has grown analysts into senior contributors, even within a small team; and CISSP required (or in progress with a 12-month commitment).
Preferred:
- Experience in asset/investment management, and familiarity with the Microsoft E5 security stack (Defender XDR, Sentinel, Purview, Entra ID, Intune) and/or PAM/EDR controls (e.g., ThreatLocker).
- Additional certifications (CISM, CRISC, GSEC, GCIH, or CCSP), exposure to AI governance frameworks (e.g., NIST AI RMF), or experience supporting institutional DDQ/RFP processes and affiliate/parent-company reporting (e.g., Natixis).
Special requirements:
- Given Incident Commander responsibilities, this role requires availability to respond to cybersecurity incidents outside of normal business hours, including nights and weekends, with occasional travel to support regulatory exams or client due diligence.
Benefits:
- medical, prescription drug, dental and vision insurance, paid time off, profit sharing plan, 401k plan, tuition reimbursement, commuter and holistic wellness benefits along with volunteer programs.
Pay:
- Expected range for this Chicago-based role $180,000 - $200,000 USD
- Also note: Actual annual base salaries may vary based on factors... If hired, base pay will be determined on an individualized basis... We could include that as prose under Pay.
We should not include filler like "commensurate with experience". The posting includes "Actual annual base salaries may vary based on factors including but not limited to education, training, experience, and other job-related factors. If hired, base pay will be determined on an individualized basis and is only one part of the total compensation package, which, depending on the position, may also include a discretionary performance bonus and other Harris sponsored benefit programs." That's substantive; we can include under Pay as prose.
Schedule: not present, so omit.
We need to output only HTML fragment, no markdown fences.
Let's craft:
- Own and mature the firm’s security operations function — monitoring, detection, and triage across XDR, DLP, and endpoint controls — in partnership with any MDR/MSSP provider.
- Serve as Incident Commander for cybersecurity incidents: direct containment, eradication, and recovery; own the incident response plan, playbooks, and tabletop exercises; lead post-incident reviews.
- Own the vulnerability management program end to end, including risk-based prioritization, remediation SLAs, and recurring reporting to IT leadership and the CISO.
- Direct third-party red team, penetration testing, and PAM initiatives; maintain threat intelligence relevant to the sector; and coordinate with Security Engineering/Infrastructure on architecture implications of findings.
- Own the enterprise cybersecurity risk register and risk-scoring methodology, mapped to the NIST Cybersecurity Framework (CSF) and, where applicable, the NIST AI Risk Management Framework (AI RMF).
- Prepare and present cybersecurity metrics, key risk indicators (KRIs), and program updates to the CISO and
About the role
At Harris, the true value of what makes us successful is found in our people. It is our unique mix of cultures, experiences, beliefs and backgrounds that sets Harris apart from the rest. We constantly strive to cultivate, nurture and amplify an unparalleled environment, where we value intellectual curiosity and uniqueness of thought. Inclusion is embedded in the very fabric of our culture of collaboration and openness. We understand that a job description only tells one part of a broader story, and Harris is seeking dynamic candidates who can add to our best-in-class environment. We recognize that qualifications can be gained through both traditional and non-traditional paths, and we are committed to considering candidates who possess the potential to be excellent in this role regardless of prior experiences. Therefore we encourage ALL interested individuals to submit their applications, even if they do not meet every requirement outlined in the job description.
The Cybersecurity team protects Harris Associates’ information assets and technology environment through security operations (detection, response, and vulnerability management) and cybersecurity risk governance (regulatory compliance, enterprise risk, third-party risk, and board reporting), reporting to the Chief Information Security Officer (CISO). The Director, Cybersecurity Operations & Risk Governance serves as the CISO’s principal deputy, running the firm’s Security Operations Center while owning the cybersecurity risk register, control framework mapping (NIST CSF, NIST AI RMF), and the firm’s obligations under the SEC Cybersecurity Rule, Regulation S-P, GLBA, and FINRA. This individual represents cybersecurity risk posture to committees and Internal Audit, acts as the CISO’s proxy when delegated, and directly leads and mentors a small, growing team of security analysts/engineers (currently 1–2 direct reports) - staying hands-on in daily operations while directing incident response, defending risk decisions to a committee, and briefing examiners or institutional clients as needed.
Responsibilities
- for any list of duties/requirements/benefits. So we can create a