SVP & Director of IT Governance - Cyber Security

SUMMARY

Provides strategic leadership and operational oversight of the Bank's technology governance, risk management, and compliance (GRC) program. Serves as a primary liaison among Technology, Risk, Audit, and executive leadership to ensure the technology risk posture aligns to regulatory expectations, enterprise risk appetite, and industry frameworks. Requires deep expertise in banking technology regulations, enterprise risk frameworks, and control design, balanced with the executive presence to communicate complex risk themes to technical and non-technical audiences, including Board-level committees.

ESSENTIAL DUTIES AND RESPONSIBILITIES

To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed below are representative of the knowledge, skill and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

Owns and matures the enterprise IT GRC program, including policies, standards, procedures, and control frameworks aligned to NIST CSF 2.0, CIS Controls v8, FFIEC CAT/Architecture, and applicable regulatory guidance (OCC, FDIC, Federal Reserve).

Establishes and maintains the technology policy hierarchy (policy standard procedure control) with defined ownership and periodic review cadence.

Serves as program owner for the technology governance council structure (e.g., IT Steering, Technology Risk), including agenda-setting, reporting, and action item tracking.

Operationalizes AI governance standards (NIST AI RMF, ISO/IEC 42001), including AI inventory, risk tiering, lifecycle controls, and oversight of vendor AI use cases.

Directs the enterprise technology risk assessment program (annual and event-driven) across infrastructure, applications, data, cloud, and third-party environments; ensure methodology aligns to ERM/RCSA and risk appetite.

Maintains and evolves the IT ris