Cyber Controls Manager, VP Job Level Vice… at Sumitomo… · Location…

• Own the Cyber Controls Library, including control objectives, descriptions, ownership, applicability, taxonomy, versioning, change governance, rationalization, and retirement.
• Maintain traceable mappings across cyber controls, the NIST Cybersecurity Framework, CRI Profile, regulatory requirements, and internal policies and standards.
• Identify coverage gaps and prepare the program for regulatory reviews.
• Lead key-control analysis and rationalization.
• Apply risk-based criteria to key-control designations and identify opportunities to remove duplication, simplify controls, and strengthen coverage.
• Guide continuous controls monitoring.
• Define and challenge key control indicators, data requirements, measurement methods, RAG thresholds, escalation criteria, and reporting with Cyber Data, Governance Engineering & Automation, and control owners.
• Design and improve controls that address cyber risks, regulatory requirements, policy obligations, audit findings, and identified gaps.
• Conduct targeted quality reviews and assess documentation, evidence, and traceability.
• Develop metrics, dashboards, and executive reporting that clearly communicate control health, trends, risk concentrations, data limitations, and decisions requiring leadership attention.
• Partner with Cyber, Technology, Internal Audit, Risk, Compliance, Operational Resilience, and control owners on inquiries, control challenges, issue interpretation, and sustainable corrective actions.
• Lead one direct report and coordinate contractors or matrixed resources.
• Set priorities, review deliverables, clarify accountability, and improve governance processes through standardization and automation.

• 6+ years of relevant experience in cybersecurity governance, technology or cyber audit, technology risk, controls assurance, first-line controls, operational risk, or a related discipline. Experience must include financial services or another highly regulated environment.
• Experience designing, assessing, challenging, mapping, rationalizing, or governing cybersecurity or technology controls.
• Frameworks and regulation: Working knowledge of the NIST Cybersecurity Framework, CRI Profile, NYDFS Part 500, FFIEC guidance, and relevant Federal Reserve or U.S. banking expectations for cybersecurity and technology risk.
• Cybersecurity: Understanding of key domains such as identity and access management, vulnerability and patch management, logging and monitoring, endpoint and network security, cloud security, data protection, secure development, third-party risk, incident response, and resilience.
• Experience working with Internal Audit, Risk, Compliance, senior leaders, and control owners, including reviewing control design, evidence, gaps, and conclusions.
• Experience leading programs or teams, setting priorities, reviewing detailed work, and delivering complex controls or governance initiatives.
• Strong analytical, written, verbal, facilitation, and presentation skills, including the ability to translate technical and regulatory requirements into clear actions and executive-level reporting.
• Bachelor’s degree or equivalent relevant professional experience.

NICE TO HAVE

• 7+ years of relevant experience, including responsibility for a significant cyber controls, technology risk, audit, regulatory, or governance program.
• Experience in both cyber or technology audit and a first-line risk, controls, or governance function.
• Experience with continuous controls monitoring, including KCIs, control-health metrics, RAG thresholds, monitoring logic, or executive dashboards.
• Knowledge of ISO/IEC 27001, NIST SP 800-53, or international cyber and operational-resilience requirements such as OSFI B-13, DORA, EBA guidance, ECB expectations, or CIMA requirements.
• Experience with an enterprise GRC platform such as SAI360, ServiceNow, Archer, or a comparable platform, and/or a relevant certification such as CISA, CISSP, CISM, or CRISC.