Managing Director, Cyber Risk & Third-Party Risk Management
State Street · Quincy, MA · 1 mo ago
Business Development$170k–$283k/yrFull-time
We need to output HTML fragment with sections: headings for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must include sections only if posting has real specific content. We must not repeat job title as heading. Must not include Job ID etc. Remove boilerplate.
We need to parse the posting.
Content:
- "Who We Are Looking For" paragraph describing role responsibilities? Actually it's description of role: "The Managing Director, Cyber Risk & Third-Party Risk Management, is responsible for leading the enterprise cyber risk management program and maintaining effective governance over cyber risk identification, assessment, monitoring, reporting, and remediation activities, including those of third parties. The role owns the Cyber Risk Framework, Cyber Controls Assurance Program (CCAP), issue management, control governance, and management of first- and second-line audits and assessments."
- "Why this role is important to us" paragraph: "This role serves as the enterprise authority for cyber risk and third-party cyber risk management practices and provides leadership insights regarding aggregate cyber risk exposure, control effectiveness, and remediation performance."
- "What You Will Be Responsible For" with subsections: Cyber Risk Framework, Third Party Cyber Risk Management, Control Governance, Issue Management, Audit Management, ETRM / Targeted Risk Assessment Management. Each has bullet-like sentences (some run-on). We need to turn into
for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must include sections only if posting has real specific content. We must not repeat job title as heading. Must not include Job ID etc. Remove boilerplate.
We need to parse the posting.
Content:
- "Who We Are Looking For" paragraph describing role responsibilities? Actually it's description of role: "The Managing Director, Cyber Risk & Third-Party Risk Management, is responsible for leading the enterprise cyber risk management program and maintaining effective governance over cyber risk identification, assessment, monitoring, reporting, and remediation activities, including those of third parties. The role owns the Cyber Risk Framework, Cyber Controls Assurance Program (CCAP), issue management, control governance, and management of first- and second-line audits and assessments."
- "Why this role is important to us" paragraph: "This role serves as the enterprise authority for cyber risk and third-party cyber risk management practices and provides leadership insights regarding aggregate cyber risk exposure, control effectiveness, and remediation performance."
- "What You Will Be Responsible For" with subsections: Cyber Risk Framework, Third Party Cyber Risk Management, Control Governance, Issue Management, Audit Management, ETRM / Targeted Risk Assessment Management. Each has bullet-like sentences (some run-on). We need to turn into - for any list of duties/requirements/benefits. So we can treat each bullet as list item.
- "What We Value" paragraph: list of skills: "Financial services and highly regulated industry experience. Experience with risk quantification methodologies and cyber risk analytics. Experience leading large-scale assurance and third-party risk transformation initiatives. Expertise in NIST, FAIR, COBIT, ISO 27001, and enterprise risk management frameworks. Strong strategic leadership and executive communication capabilities."
- "Education & Preferred Qualifications": list of qualifications: "15+ years of experience in cybersecurity risk management, technology risk, operational risk, audit, assurance, or enterprise risk leadership. Significant experience managing enterprise cyber risk and third-party risk programs. Deep expertise in cyber risk frameworks, control assurance, issue management, control governance, and audit management. Proven experience presenting aggregate risk themes and recommendations to executive leadership and Board committees. Strong understanding of risk appetite, risk quantification, assurance practices, and regulatory expectations. Bachelor's degree required; advanced degree preferred. CISSP, CRISC, CISM, CISA, or equivalent certifications."
- "Salary Range $170,000 - $282,500 Annual The range quoted above applies to the role in the primary location specified. If the candidate would ultimately work outside of the primary location above, the applicable range could differ. Employees are eligible to participate in State Street’s comprehensive benefits program, which includes: our retirement savings plan (401K) with company match; insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages; paid-time off including vacation, sick leave, short term disability, and family care responsibilities; access to our Employee Assistance Program; incentive compensation including eligibility for annual performance-based awards (excluding certain sales roles subject to sales incentive plans); and, eligibility for certain tax advantaged savings plans. For a full overview, visit https://hrportal.ehr.com/statestreet/Home."
- Then "About State Street" paragraph (company description). This is boilerplate? Might be considered generic but it's about company; we might keep as "About the role"? Actually we have "Who We Are Looking For" and "Why this role is important to us". Could treat as "About the role" section.
We need to produce sections: maybe "About the role", "Responsibilities", "Requirements", "Qualifications", "Skills", "Benefits", "Pay". But we must only include sections when posting has real specific content.
We have content for:
- About the role: "Who We Are Looking For" and "Why this role is important to us". That's substantive.
- Responsibilities: "What You Will Be Responsible For" with subpoints.
- Requirements: maybe "Education & Preferred Qualifications" (experience, degree, certifications). Could be considered Requirements.
- Qualifications: maybe overlapping with Requirements; but we can combine? The instruction says use headings for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). We can decide to include Requirements and Qualifications separately if distinct. However the posting lumps experience and education under "Education & Preferred Qualifications". Could treat as Qualifications. Requirements maybe not separately listed. Could skip Requirements if not distinct.
- Skills: "What We Value" list.
- Benefits: list from benefits paragraph.
- Pay: Salary range.
- Schedule: not mentioned, so omit.
We must not include placeholder text like "commensurate with experience". Not present.
We must not repeat job title as heading. So we won't put "Managing Director, Cyber Risk & Third-Party Risk Management" as heading.
We must not include Job ID etc.
We need to preserve ALL substantive information; do not invent or summarize away detail. So we need to keep all details from each section.
We need to format as HTML fragment: use
for headings, - for lists,
for prose.
We need to ensure we don't include any markdown fences.
Let's craft.
First, maybe a
for introductory description? The "Who We Are Looking For" and "Why this role is important to us" could be combined into a
under About the role heading.
We'll produce:
About the role
The Managing Director, Cyber Risk & Third-Party Risk Management, is responsible for leading the enterprise cyber risk management program and maintaining effective governance over cyber risk identification, assessment, monitoring, reporting, and remediation activities, including those of third parties. The role owns the Cyber Risk Framework, Cyber Controls Assurance Program (CCAP), issue management, control governance, and management of first- and second-line audits and assessments. This role serves as the enterprise authority for cyber risk and third-party cyber risk management practices and provides leadership insights regarding aggregate cyber risk exposure, control effectiveness, and remediation performance.
Then Responsibilities:
Responsibilities
- Cyber Risk Framework: Influence enhancements to and operationalize Cyber Risk Management Framework including cyber risk taxonomy, methodologies, risk appetite alignment, risk reporting standards, assurance methodologies, testing standards, and control evaluation practices; ensure cyber risks are consistently identified, assessed, monitored, escalated, and reported across the organization; support risk aggregation, risk quantification, and emerging risk assessment activities; lead the development, maturation, and maintenance of comprehensive cyber risk metrics and Key Risk Indicators (KRI) that provide meaningful, actionable insight into residual cyber risk, emerging trends, control maturity, and risk reduction outcomes, supporting executive, board, and regulatory oversight and risk-based decision making; oversee assessment execution, quality assurance, challenge, and consistency across cybersecurity process areas and control domains; monitor control effectiveness and remediation outcomes; drive continuous improvement in assurance coverage and risk visibility.
- Third Party Cyber Risk Management: Own the Third-Party Cyber Risk Management framework and program; serve as EPO Delegate for TPCRM; oversee supplier cyber risk assessments, monitoring, remediation, and reporting; govern critical supplier risk, concentration risk, and third-party control effectiveness; ensure regulatory and enterprise requirements are embedded within TPCRM activities.
- Control Governance: Own cybersecurity control governance and accountability structures; collaborate with FLRC to ensure appropriate control ownership, visibility, evidence requirements, and testing expectations support the risk framework; ensure alignment between controls, risks, findings, and remediation activities; drive continual improvement and rationalization of cybersecurity controls.
- Issue Management: Lead governance of cybersecurity issue management processes; oversee issue intake, severity assessment, escalation, remediation tracking, validation, and closure; monitor issue aging, systemic risk themes, and remediation effectiveness; escalate material cyber risks through governance and executive forums.
- Audit Management: Lead cybersecurity audit management activities; coordinate internal audit, external audit, and regulatory audit engagements; oversee findings governance, remediation tracking, and closure validation; monitor systemic themes and recurring control weaknesses.
- ETRM / Targeted Risk Assessment Management: Serve as primary cybersecurity partner to ETRM, ensuring TRA scoping well-defined and TRA outcomes are appropriately reflecting cyber risk; coordinate technology risk assessment governance, challenge, and reporting; ensure consistency and quality of TRAs and risk outcomes.
Now Skills (What We Value):
Skills
- Financial services and highly regulated industry experience.
- Experience with risk quantification methodologies and cyber risk analytics.
- Experience leading large-scale assurance and third-party risk transformation initiatives.
- Expertise in NIST, FAIR, COBIT, ISO 27001, and enterprise risk management frameworks.
- Strong strategic leadership and executive communication capabilities.
Qualifications (Education & Preferred Qualifications):
Qualifications
- 15+ years of experience in cybersecurity risk management, technology risk, operational risk, audit, assurance, or enterprise risk leadership.
- Significant experience managing enterprise cyber risk and third-party risk programs.
- Deep expertise in cyber risk frameworks, control assurance, issue management, control governance, and audit management.
- Proven experience presenting aggregate risk themes and recommendations to executive leadership and Board committees.
- Strong understanding of risk appetite, risk quantification, assurance practices, and regulatory expectations.
- Bachelor's degree required; advanced degree preferred.
- CISSP, CRISC, CISM, CISA, or equivalent certifications.
Benefits:
Benefits
- Retirement savings plan (401K) with company match.
- Insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages.
- Paid-time off including vacation, sick leave, short term disability, and family care responsibilities.
- Access to Employee Assistance Program.
- Incentive compensation including eligibility for annual performance-based awards (excluding certain sales roles subject to sales incentive plans).
- Eligibility for certain tax advantaged savings plans.
Pay:
Pay
Salary range: $170,000 - $282,500 annual. The range quoted above applies to the role in the primary location specified. If the candidate would ultimately work outside of the primary location above, the applicable range could differ.
We should not include Schedule.
We must ensure we didn't include any boilerplate like "About State Street", "Equal Opportunity Employer", etc. We omitted those.
Check that we preserved all substantive info: Did we miss any details? Let's review original:
- "Who We Are Looking For" paragraph: we included.
- "Why this role is important to us": included.
- "What You Will Be Responsible For": we captured each bullet but need to ensure we didn't lose any nuance. Let's verify each subheading content:
Original:
Cyber Risk Framework Influence enhancements to and operationalize Cyber Risk Management Framework including cyber risk taxonomy, methodologies, risk appetite alignment, risk reporting standards, assurance methodologies, testing standards, and control evaluation practices.Ensure cyber risks are consistently identified, assessed, monitored, escalated, and reported across the organization.Support risk aggregation, risk quantification, and emerging risk assessment activities.Lead the development, maturation, and maintenance of comprehensive cyber risk metrics and Key Risk Indicators (KRI) that provide meaningful, actionable insight into residual cyber risk, emerging trends, control maturity, and risk reduction outcomes, supporting executive, board, and regulatory oversight and risk-based decision making.Oversee assessment execution, quality assurance, challenge, and consistency across cybersecurity process areas and control domains.Monitor control effectiveness and
for headings, - for lists,
for prose.
We need to ensure we don't include any markdown fences.
Let's craft.
First, maybe a
for introductory description? The "Who We Are Looking For" and "Why this role is important to us" could be combined into a
under About the role heading.
We'll produce:
About the role
The Managing Director, Cyber Risk & Third-Party Risk Management, is responsible for leading the enterprise cyber risk management program and maintaining effective governance over cyber risk identification, assessment, monitoring, reporting, and remediation activities, including those of third parties. The role owns the Cyber Risk Framework, Cyber Controls Assurance Program (CCAP), issue management, control governance, and management of first- and second-line audits and assessments. This role serves as the enterprise authority for cyber risk and third-party cyber risk management practices and provides leadership insights regarding aggregate cyber risk exposure, control effectiveness, and remediation performance.
Then Responsibilities:
Responsibilities
- Cyber Risk Framework: Influence enhancements to and operationalize Cyber Risk Management Framework including cyber risk taxonomy, methodologies, risk appetite alignment, risk reporting standards, assurance methodologies, testing standards, and control evaluation practices; ensure cyber risks are consistently identified, assessed, monitored, escalated, and reported across the organization; support risk aggregation, risk quantification, and emerging risk assessment activities; lead the development, maturation, and maintenance of comprehensive cyber risk metrics and Key Risk Indicators (KRI) that provide meaningful, actionable insight into residual cyber risk, emerging trends, control maturity, and risk reduction outcomes, supporting executive, board, and regulatory oversight and risk-based decision making; oversee assessment execution, quality assurance, challenge, and consistency across cybersecurity process areas and control domains; monitor control effectiveness and remediation outcomes; drive continuous improvement in assurance coverage and risk visibility.
- Third Party Cyber Risk Management: Own the Third-Party Cyber Risk Management framework and program; serve as EPO Delegate for TPCRM; oversee supplier cyber risk assessments, monitoring, remediation, and reporting; govern critical supplier risk, concentration risk, and third-party control effectiveness; ensure regulatory and enterprise requirements are embedded within TPCRM activities.
- Control Governance: Own cybersecurity control governance and accountability structures; collaborate with FLRC to ensure appropriate control ownership, visibility, evidence requirements, and testing expectations support the risk framework; ensure alignment between controls, risks, findings, and remediation activities; drive continual improvement and rationalization of cybersecurity controls.
- Issue Management: Lead governance of cybersecurity issue management processes; oversee issue intake, severity assessment, escalation, remediation tracking, validation, and closure; monitor issue aging, systemic risk themes, and remediation effectiveness; escalate material cyber risks through governance and executive forums.
- Audit Management: Lead cybersecurity audit management activities; coordinate internal audit, external audit, and regulatory audit engagements; oversee findings governance, remediation tracking, and closure validation; monitor systemic themes and recurring control weaknesses.
- ETRM / Targeted Risk Assessment Management: Serve as primary cybersecurity partner to ETRM, ensuring TRA scoping well-defined and TRA outcomes are appropriately reflecting cyber risk; coordinate technology risk assessment governance, challenge, and reporting; ensure consistency and quality of TRAs and risk outcomes.
Now Skills (What We Value):
Skills
- Financial services and highly regulated industry experience.
- Experience with risk quantification methodologies and cyber risk analytics.
- Experience leading large-scale assurance and third-party risk transformation initiatives.
- Expertise in NIST, FAIR, COBIT, ISO 27001, and enterprise risk management frameworks.
- Strong strategic leadership and executive communication capabilities.
Qualifications (Education & Preferred Qualifications):
Qualifications
- 15+ years of experience in cybersecurity risk management, technology risk, operational risk, audit, assurance, or enterprise risk leadership.
- Significant experience managing enterprise cyber risk and third-party risk programs.
- Deep expertise in cyber risk frameworks, control assurance, issue management, control governance, and audit management.
- Proven experience presenting aggregate risk themes and recommendations to executive leadership and Board committees.
- Strong understanding of risk appetite, risk quantification, assurance practices, and regulatory expectations.
- Bachelor's degree required; advanced degree preferred.
- CISSP, CRISC, CISM, CISA, or equivalent certifications.
Benefits:
Benefits
- Retirement savings plan (401K) with company match.
- Insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages.
- Paid-time off including vacation, sick leave, short term disability, and family care responsibilities.
- Access to Employee Assistance Program.
- Incentive compensation including eligibility for annual performance-based awards (excluding certain sales roles subject to sales incentive plans).
- Eligibility for certain tax advantaged savings plans.
Pay:
Pay
Salary range: $170,000 - $282,500 annual. The range quoted above applies to the role in the primary location specified. If the candidate would ultimately work outside of the primary location above, the applicable range could differ.
We should not include Schedule.
We must ensure we didn't include any boilerplate like "About State Street", "Equal Opportunity Employer", etc. We omitted those.
Check that we preserved all substantive info: Did we miss any details? Let's review original:
- "Who We Are Looking For" paragraph: we included.
- "Why this role is important to us": included.
- "What You Will Be Responsible For": we captured each bullet but need to ensure we didn't lose any nuance. Let's verify each subheading content:
Original:
Cyber Risk Framework Influence enhancements to and operationalize Cyber Risk Management Framework including cyber risk taxonomy, methodologies, risk appetite alignment, risk reporting standards, assurance methodologies, testing standards, and control evaluation practices.Ensure cyber risks are consistently identified, assessed, monitored, escalated, and reported across the organization.Support risk aggregation, risk quantification, and emerging risk assessment activities.Lead the development, maturation, and maintenance of comprehensive cyber risk metrics and Key Risk Indicators (KRI) that provide meaningful, actionable insight into residual cyber risk, emerging trends, control maturity, and risk reduction outcomes, supporting executive, board, and regulatory oversight and risk-based decision making.Oversee assessment execution, quality assurance, challenge, and consistency across cybersecurity process areas and control domains.Monitor control effectiveness and
for prose. We need to ensure we don't include any markdown fences. Let's craft. First, maybe a
for introductory description? The "Who We Are Looking For" and "Why this role is important to us" could be combined into a
under About the role heading. We'll produce:
About the role
The Managing Director, Cyber Risk & Third-Party Risk Management, is responsible for leading the enterprise cyber risk management program and maintaining effective governance over cyber risk identification, assessment, monitoring, reporting, and remediation activities, including those of third parties. The role owns the Cyber Risk Framework, Cyber Controls Assurance Program (CCAP), issue management, control governance, and management of first- and second-line audits and assessments. This role serves as the enterprise authority for cyber risk and third-party cyber risk management practices and provides leadership insights regarding aggregate cyber risk exposure, control effectiveness, and remediation performance.
Then Responsibilities:Responsibilities
- Cyber Risk Framework: Influence enhancements to and operationalize Cyber Risk Management Framework including cyber risk taxonomy, methodologies, risk appetite alignment, risk reporting standards, assurance methodologies, testing standards, and control evaluation practices; ensure cyber risks are consistently identified, assessed, monitored, escalated, and reported across the organization; support risk aggregation, risk quantification, and emerging risk assessment activities; lead the development, maturation, and maintenance of comprehensive cyber risk metrics and Key Risk Indicators (KRI) that provide meaningful, actionable insight into residual cyber risk, emerging trends, control maturity, and risk reduction outcomes, supporting executive, board, and regulatory oversight and risk-based decision making; oversee assessment execution, quality assurance, challenge, and consistency across cybersecurity process areas and control domains; monitor control effectiveness and remediation outcomes; drive continuous improvement in assurance coverage and risk visibility.
- Third Party Cyber Risk Management: Own the Third-Party Cyber Risk Management framework and program; serve as EPO Delegate for TPCRM; oversee supplier cyber risk assessments, monitoring, remediation, and reporting; govern critical supplier risk, concentration risk, and third-party control effectiveness; ensure regulatory and enterprise requirements are embedded within TPCRM activities.
- Control Governance: Own cybersecurity control governance and accountability structures; collaborate with FLRC to ensure appropriate control ownership, visibility, evidence requirements, and testing expectations support the risk framework; ensure alignment between controls, risks, findings, and remediation activities; drive continual improvement and rationalization of cybersecurity controls.
- Issue Management: Lead governance of cybersecurity issue management processes; oversee issue intake, severity assessment, escalation, remediation tracking, validation, and closure; monitor issue aging, systemic risk themes, and remediation effectiveness; escalate material cyber risks through governance and executive forums.
- Audit Management: Lead cybersecurity audit management activities; coordinate internal audit, external audit, and regulatory audit engagements; oversee findings governance, remediation tracking, and closure validation; monitor systemic themes and recurring control weaknesses.
- ETRM / Targeted Risk Assessment Management: Serve as primary cybersecurity partner to ETRM, ensuring TRA scoping well-defined and TRA outcomes are appropriately reflecting cyber risk; coordinate technology risk assessment governance, challenge, and reporting; ensure consistency and quality of TRAs and risk outcomes.
Skills
- Financial services and highly regulated industry experience.
- Experience with risk quantification methodologies and cyber risk analytics.
- Experience leading large-scale assurance and third-party risk transformation initiatives.
- Expertise in NIST, FAIR, COBIT, ISO 27001, and enterprise risk management frameworks.
- Strong strategic leadership and executive communication capabilities.
Qualifications
- 15+ years of experience in cybersecurity risk management, technology risk, operational risk, audit, assurance, or enterprise risk leadership.
- Significant experience managing enterprise cyber risk and third-party risk programs.
- Deep expertise in cyber risk frameworks, control assurance, issue management, control governance, and audit management.
- Proven experience presenting aggregate risk themes and recommendations to executive leadership and Board committees.
- Strong understanding of risk appetite, risk quantification, assurance practices, and regulatory expectations.
- Bachelor's degree required; advanced degree preferred.
- CISSP, CRISC, CISM, CISA, or equivalent certifications.
Benefits
- Retirement savings plan (401K) with company match.
- Insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages.
- Paid-time off including vacation, sick leave, short term disability, and family care responsibilities.
- Access to Employee Assistance Program.
- Incentive compensation including eligibility for annual performance-based awards (excluding certain sales roles subject to sales incentive plans).
- Eligibility for certain tax advantaged savings plans.
Pay
Salary range: $170,000 - $282,500 annual. The range quoted above applies to the role in the primary location specified. If the candidate would ultimately work outside of the primary location above, the applicable range could differ.
We should not include Schedule. We must ensure we didn't include any boilerplate like "About State Street", "Equal Opportunity Employer", etc. We omitted those. Check that we preserved all substantive info: Did we miss any details? Let's review original: - "Who We Are Looking For" paragraph: we included. - "Why this role is important to us": included. - "What You Will Be Responsible For": we captured each bullet but need to ensure we didn't lose any nuance. Let's verify each subheading content: Original: Cyber Risk Framework Influence enhancements to and operationalize Cyber Risk Management Framework including cyber risk taxonomy, methodologies, risk appetite alignment, risk reporting standards, assurance methodologies, testing standards, and control evaluation practices.Ensure cyber risks are consistently identified, assessed, monitored, escalated, and reported across the organization.Support risk aggregation, risk quantification, and emerging risk assessment activities.Lead the development, maturation, and maintenance of comprehensive cyber risk metrics and Key Risk Indicators (KRI) that provide meaningful, actionable insight into residual cyber risk, emerging trends, control maturity, and risk reduction outcomes, supporting executive, board, and regulatory oversight and risk-based decision making.Oversee assessment execution, quality assurance, challenge, and consistency across cybersecurity process areas and control domains.Monitor control effectiveness and