Cybersecurity Risk Governance Principal

We are looking for a talented Cybersecurity Risk Governance Principal to join our team specializing in Systems/Information Technology for our Corporate organization. This is a remote role.  

In this role, you will make an impact in the following ways:

Responsibilities

To be successful in this role you will need the following:

Balances stakeholders - Anticipating and balancing the needs of multiple stakeholders.

Business insight - Applying knowledge of business and the marketplace to advance the organization’s goals.

Demonstrates self-awareness - Using a combination of feedback and reflection to gain productive insight into personal strengths and weaknesses.

Develops talent - Developing people to meet both their career goals and the organization’s goals.

Global perspective - Taking a broad view when approaching issues, using a global lens.

Manages complexity - Making sense of complex, high quantity, and sometimes contradictory information to effectively solve problems.

Persuades - Using compelling arguments to gain the support and commitment of others.

Plans and aligns - Planning and prioritizing work to meet commitments aligned with organizational goals.

Resourcefulness - Securing and deploying resources effectively and efficiently.

Strategic mindset - Seeing ahead to future possibilities and translating them into breakthrough strategies.

Facilitation - Guides group discussions or training by creating an active environment where questions are posed, perspectives are shared, and debates occur with the goal of gaining understanding, analyzing issues, resolving conflict, exploring solutions, or making decisions.

Cybersecurity Risk Management - Identifies and assesses the potential impact of Cybersecurity risks against established Cybersecurity industry frameworks, regulations and organizational policies to develop and implement risk mitigation strategies in alignment with business objectives.

Values differences - Recognizing the value that different perspectives and cultures bring to an organization. 

Education, Licenses, Certifications: 
College, university, or equivalent degree in Cybersecurity, Computer Science, or Information Technology, or related subject, or relevant equivalent experience required. This position may require licensing for compliance with export controls or sanctions regulations. 

Experience: 
Significant level of relevant work experience required. 5-7 years of experience

Qualifications

This role leads enterprise cybersecurity risk governance, connecting security functions and business stakeholders to prioritize and reduce strategic cyber risks in line with business objectives and risk appetite.  

• Risk governance leadership: The manager administers the enterprise cyber risk governance process, ensures consistent risk identification and reporting, guides risk acceptance, and recommends treatment strategies and investment priorities based on risk reduction value and business impact.   
• Cross-functional risk orchestration: The role integrates threat intelligence and emerging threat trends into treatment priorities, coordinates stakeholders across cybersecurity, legal, privacy, compliance, and business units, resolves roadblocks, and ensures treatment plans have owners, funding paths, and timelines. It also presents risk posture and business impacts to senior leadership and supports enterprise risk management committees.    
• Qualifications and environment: Candidates need a bachelor’s degree in cybersecurity, information technology, or a related field; 5 to 7 years of cybersecurity experience, including 3 to 5 years in cybersecurity risk management or enterprise risk management; familiarity with NIST RMF, FAIR, or quantitative risk methods; and knowledge of threat intelligence, security operations, identity and access management, cloud security, privacy, legal risk, and regulatory requirements. Strong communication, analytical, organizational, and collaboration skills are required, while CISSP, CISM, or equivalent certification is preferred.   
•  

The Cybersecurity Risk Governance Manager will serve as the central orchestrator between Governance, BRI, Cyber Threat Intelligence, Cyber Operations, and Business stakeholders to ensure enterprise strategic cyber risks are understood, prioritized, and reduced through coordinated treatment strategies aligned with business objectives and risk appetite. 

1. Enterprise Risk Governance:

   • Leads the operation and administration of the enterprise cyber risk governance process under the direction of Cybersecurity Governance leadership.

   • Ensure risks are consistently identified, assessed, categorized, and reported.

   • Facilitate risk acceptance governance and provide recommendations to decision-makers.

2. Strategic Risk Treatment Leadership:

   • Recommend enterprise-wide treatment strategies targeting root causes rather than individual issues.

   • Recommend risk reduction investment priorities based on risk reduction value and business impact.

3. Threat and Intelligence Integration:

   • Partner closely with BRI and Cyber Threat Intelligence to address emerging threats.

   • Translate threat trends, intelligence reports, and emerging risk drivers into strategic risk treatment priorities.

   • Assess how evolving threat activity impacts enterprise risk exposure.

4. Cross-Functional Orchestration:

   • Convene stakeholders from Cyber Ops, IAM, Infrastructure, Application Security, Compliance, Privacy, Legal, and Business Units.

   • Resolve roadblocks impacting risk reduction initiatives. 

   • Ensure strategic treatment plans have accountable owners, funding paths, and timelines.

5. Executive Risk Communication & Reporting: 
   • Present risk posture and treatment progress to senior leadership.
   • Translate technical cyber risks into business impacts (Financial, Operational, Regulatory, Reputational)
   • Support ERM & governance committees as Cybersecurity Risk Expert.
6. Risk Exception & Acceptance Governance: 
   • Define and govern risk acceptance criteria, approval authorities, oversight requirements and exception management processes.
   • Establish and oversee the governance framework for risk acceptance and exceptions.