Director, Risk Management: Cyber & Third Party Risk

We need to output HTML fragment with headings

for sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We need to parse the posting. We have job title: Director, Risk Management: Cyber & Third Party Risk Capital One... The page already shows title, so we do NOT repeat job title as heading. We need to include sections: About the role (likely the introductory paragraph). Responsibilities (list). Requirements (basic qualifications). Qualifications (preferred qualifications). Skills (maybe combine? but we can include if there is content). Benefits (they mention comprehensive benefits). Pay (they gave salary ranges). Schedule (maybe travel up to 10% when applicable). Also maybe mention "Travel up to 10%" as schedule. We must not include boilerplate like EEO, legal, application instructions, etc. We must preserve all substantive info, not invent or summarize away detail. Must not create sections with filler like "commensurate with experience". So we need to ensure each section has actual content. Let's extract content. Introductory paragraph(s): "Director, Risk Management: Cyber & Third Party Risk Capital One, a Fortune 500 company and one of the nation’s top 10 banks, offers a broad spectrum of financial products and services to consumers, small businesses and commercial clients. We are on the path to create one of the nation’s great banks, and we have the necessary ingredients: a strong balance sheet, resilient businesses, a massive customer franchise, strong analytical capabilities, and great people. We nurture a work environment where people with a variety of thoughts, ideas and backgrounds, guided by our shared Values, come together to make Capital One a great company – and a great place to work. As a Director, Third Party Risk in Capital One’s Card Risk Office, you will lead our Third Party Risk team, leveraging foundations in third party risk management and applying background and experience with technology and cyber risks. You will partner across the divisional senior leaders for Enterprise Supplier Management, Cyber, Card Technology, Card Risk teams to develop and support best-in-class industry risk solutions in a manner that supports innovation and protects our customers, shareholders, and associates. You will collaborate with second lines of defense to lead and implement risk and control tools, techniques, and frameworks for the Card organization. Your contributions will drive organizational change through risk identification, measurement, analysis, and reporting in order to better manage the company’s risk in an open and collaborative environment. The Risk Office is accountable to leadership to identify and mitigate risks, ensure compliance with laws/regulations/policies, and detect and remediate issues. Proficiency in risk management program (ideally technology risk-driven programs) development and management are key to success in this role. The successful candidate will be an experienced risk management professional who understands third party operational risk, with strong analytical, planning, strategic thinking, organizational, and communication skills." That's about the role. Responsibilities: list after "Role Responsibilities:" then bullet points. Let's extract bullet points: - Drive team initiatives to improve overarching third-party risk management and vendor lifecycle, focusing on automation, innovation, and process improvements. - Engage with cross functional executive leadership across Card, Risk, Supplier Management, and Cyber in delivering clear compelling narratives and program status. - Leverage your expertise to make sound judgment decisions in various third party domains such as contracting risk, operational delivery, information security, and resilience to inform actions and prioritization in risk aggregation. - Serve as interdepartmental advisor, interfacing with enterprise technology and other lines of business and other areas such as Cyber and enterprise technology - Collaborate effectively across multiple organizations to achieve objectives - Deliver appropriate, succinct and organized information, tailoring communication style to audience. - Communicate complex issues and implications, incorporating different perspectives and solutions into deliverables. - Conduct analysis of data extracts in order to identify trends, patterns, and anomalies to draw conclusions and escalate key risks and issues - Facilitate and ensure compliance with policies through risk assessments and enterprise risk management programs - Identify opportunities for continued improvement in the business - Identify, document and track resolution of risk events / issues impacting customers stemming from process breakdowns or other problems, and help develop permanent corrective actions - Manage special projects - Travel up to 10% when applicable We need to ensure we keep all. Basic Qualifications: list: - Bachelor’s Degree or Military Experience - At least 7 years of experience working in risk management - At least 5 years of experience in information technology, including software delivery/hosting, platform services, information security or cloud computing - At least 5 years of experience in third party risk management, including vendor risk and control assessment programs - At least 5 years of experience in people management Preferred Qualifications: - Master's Degree - 8+ years of experience in information technology management - 8+ years of experience in third party risk management - 8+ years of experience working in risk management - 6+ years of experience in people management - Certifications related to or pursuing certification related to Cloud, Cyber or Technology Operations, such as Cloud provider certifications, Certified Information Systems Security Professional (CISSP), or Certified Information Security Manager (CISM), or Certified Information Systems Auditor (CISA) - PMP, Lean, Agile, or Six Sigma certification - 5+ years of experience in Banking and/or Financial Services. - 5+ years of experience evaluating, implementing, or managing cyber or information security Also note: "At this time, Capital One will not sponsor a new applicant for employment authorization for this position." That's a note but maybe considered metadata; we could fold into a short p or drop? The instruction: "do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short

or drop it." This line is about sponsorship; could be considered minor metadata. Might drop or include as a p. Probably drop as it's not essential? But it's substantive? It's a restriction. Might be considered important. However instruction says "fold minor metadata into a short

or drop it." This is not job ID but maybe still metadata. I'd include as a short p under maybe Requirements? But better to include as a p after qualifications? Not a heading. We'll include as a p after Qualifications maybe. Pay: they gave salary ranges per location. That's substantive. So we need a Pay section with that info. Benefits: they mention comprehensive benefits, link to learn more. That's substantive enough for Benefits section. Schedule: travel up to 10% when applicable (already in responsibilities). Could also be schedule. But we already have travel in responsibilities; maybe we don't need separate Schedule section unless there is other schedule info like full-time, etc. Not given. So we may omit Schedule section because no specific schedule besides travel. The instruction: "never create Pay/Schedule/Benefits sections unless the posting actually states them." Travel is mentioned but not as schedule; but schedule could be implied. However we have travel in responsibilities; we could still include Schedule section with that travel note. But we might avoid duplication. The instruction: prefer a few substantive sections over many thin ones. So we could omit Schedule and keep travel under Responsibilities. Thus sections: About the role, Responsibilities, Requirements (Basic Qualifications), Qualifications (Preferred Qualifications), Skills? There's no explicit skills list besides maybe "strong analytical, planning, strategic thinking, organizational, and communication skills" which is in About the role. Could create Skills section but we might not need separate if covered. However we have content for skills: "strong analytical, planning, strategic thinking, organizational, and communication skills." That's from About the role. Could we extract into Skills? But we must not invent or summarize away detail; we could keep it in About the role. The instruction: "Prefer a few substantive sections over many thin ones." So we could combine skills into About the role or Qualifications. I'd keep About the role as is, and not create Skills section unless there is a distinct list. There's no separate skills bullet list. So omit Skills. Benefits: we have paragraph: "Capital One offers a comprehensive, competitive, and inclusive set of health, financial and other benefits that support your total well-being. Learn more at the Capital One Careers website. Eligibility varies based on full or part-time status, exempt or non-exempt status, and management level." That's substantive. Pay: we have salary ranges per location. Also note about performance based incentive compensation. That's also pay-related. So include that. Now we need to output HTML fragment with

headings and

• for lists,

  for prose. We must not include or . Just the fragment. We need to ensure we preserve all substantive info. Let's craft. About the role: combine the introductory paragraphs into one or multiple

  tags. We'll keep as

  maybe multiple paragraphs. Responsibilities:

  Responsibilities

  then
  with each bullet as
  • . Requirements:

    Requirements

    then
    for basic qualifications. Qualifications:

    Qualifications

    then
    for preferred qualifications. We might also include a note about sponsorship as a

    after Qualifications maybe. Benefits:

    Benefits

    then

    with benefits text. Pay:

    Pay

    then

    with salary ranges and incentive note. We must not include fluff like "Learn more at the Capital One Careers website." That's okay. Now let's write. Check for any duplicated lines: we should not repeat. Let's extract exact text. About the role text: I'll combine into maybe two paragraphs: first paragraph about Capital One overview, second about role specifics. Paragraph1: "Director, Risk Management: Cyber & Third Party Risk Capital One, a Fortune 500 company and one of the nation’s top 10 banks, offers a broad spectrum of financial products and services to consumers, small businesses and commercial clients. We are on the path to create one of the nation’s great banks, and we have the necessary ingredients: a strong balance sheet, resilient businesses, a massive customer franchise, strong analytical capabilities, and great people. We nurture a work environment where people with a variety of thoughts, ideas and backgrounds, guided by our shared Values, come together to make Capital One a great company – and a great place to work." Paragraph2: "As a Director, Third Party Risk in Capital One’s Card Risk Office, you will lead our Third Party Risk team, leveraging foundations in third party risk management and applying background and experience with technology and cyber risks. You will partner across the divisional senior leaders for Enterprise Supplier Management, Cyber, Card Technology, Card Risk teams to develop and support best-in-class industry risk solutions in a manner that supports innovation and protects our customers, shareholders, and associates. You will collaborate with second lines of defense to lead and implement risk and control tools, techniques, and frameworks for the Card organization. Your contributions will drive organizational change through risk identification, measurement, analysis, and reporting in order to better manage the company’s risk in an open and collaborative environment. The Risk Office is accountable to leadership to identify and mitigate risks, ensure compliance with laws/regulations/policies, and detect and remediate issues. Proficiency in risk management program (ideally technology risk-driven programs) development and management are key to success in this role. The successful candidate will be an experienced risk management professional who understands third party operational risk, with strong analytical, planning, strategic thinking, organizational, and communication skills." That seems good. Now Responsibilities list: need to ensure each bullet is accurate. Let's list them exactly as in text: - Drive team initiatives to improve overarching third-party risk management and vendor lifecycle, focusing on automation, innovation, and process improvements. - Engage with cross functional executive leadership across Card, Risk, Supplier Management, and Cyber in delivering clear compelling narratives and program status. - Leverage your expertise to make sound judgment decisions in various third party domains such as contracting risk, operational delivery, information security, and resilience to inform actions and prioritization in risk aggregation. -