IT Risk & Control Director - Cybersecurity

About the Role

The Technology Risk & Control Director – Cybersecurity is a senior front-line Technology Risk leader responsible for providing risk insight, advisory support, and effective challenge across cybersecurity and information protection domains. This role collaborates with Cybersecurity and Technology leaders to establish and maintain standards, procedures, controls, metrics, and operational practices, without assuming ownership responsibilities. The position focuses on helping leaders understand risk exposure, evaluate control effectiveness, identify emerging risks, and make informed decisions.

Responsibilities

• Serve as a senior Technology Risk partner to Cybersecurity and Technology leadership, offering risk insight, advice, and constructive challenge.
• Build collaborative relationships with Cybersecurity, Technology, Data, business-aligned teams, Independent Risk, Compliance, Legal, Privacy, Audit, and other stakeholders.
• Provide risk insight across IAM, PAM, Data Protection, Cloud Security, Vulnerability Management, Application Security, Security Architecture, and Cybersecurity Operations.
• Partner with control owners to assess risks in identity lifecycle management, privileged access, and data protection practices.
• Advise on risk considerations for cloud adoption, data security, and vulnerability management.
• Analyze cybersecurity risks to identify systemic issues, risk concentrations, and emerging trends.
• Contribute to executive-level risk assessments, reporting, and decision materials.
• Participate in governance forums, providing risk insights and trends.
• Lead and develop a high-performing Technology Risk team.

Qualifications

• Bachelor's degree or equivalent work experience.
• 10+ years in a related role.

Preferred Qualifications

• Significant experience in first-line technology risk or cybersecurity risk functions within regulated organizations.
• Expertise in IAM/PAM, Data Protection, Cloud Security, and Vulnerability Management.
• Experience operating within the three lines model and partnering with control owners, Independent Risk, and Audit.
• Ability to translate complex cybersecurity conditions into business risk and executive insights.
• Leadership experience in developing risk talent within matrixed organizations.
• Deep understanding of cybersecurity frameworks (NIST, CIS, ISO/IEC 27001) and cloud environments (Azure, AWS, GCP).
• Strong executive communication and collaboration skills.
• Relevant certifications (CISSP, CISM, CRISC, CISA, CCSP) preferred.

Pay

Compensation Range: $125,000 - $255,000 Annual Salary

Schedule

Exempt Status: Yes (not eligible for overtime pay)

Workplace Type

Office-based with flexible work arrangements available for certain positions. Combines in-office and remote work to deepen connections and maintain community.