CRO - Information Security & Risk Oversight Lead

Details

The Information Security Risk Oversight Lead will translate cybersecurity risk into executive insight and action. Sitting in the Company’s Second Line of Defense within the Chief Risk Office and reporting directly to the Head of Technology Risk, this role provides independent oversight and credible challenge across the firm’s enterprise-wide information security program. The role operates at the intersection of technology, risk management, cybersecurity, governance, and strategy, partnering with the Chief Information Security Office, Engineering, and CTO teams to ensure cyber risks are identified, measured, monitored, and aligned with the firm’s risk appetite.

Responsibilities

• Serve as the primary Second Line risk advisor for cybersecurity-related risks and lead independent oversight and credible challenge of First Line of Defense activities.
• Identify and measure threat-actor-initiated risks and risk scenarios that may impact the confidentiality, integrity, and availability of information systems.
• Evaluate the design and operating effectiveness of security controls, particularly across complex, high-risk, or enterprise-scale technology initiatives.
• Quantify risk and control posture to support executive decision-making through scenario analysis and metrics, including KRIs, KPIs, SLA/SLOs, and ALE.
• Review and challenge security-driven programs and initiatives to ensure alignment with enterprise risk appetite, industry control frameworks, and regulatory expectations.
• Partner closely with Information Security and Engineering teams to enhance risk awareness, accountability, and control ownership.
• Identify root causes of control failures, security incidents, or systemic weaknesses and support the development of actionable, preventative recommendations.
• Prepare and present risk oversight materials to senior leadership committees, internal audit, the Board of Directors, and regulatory bodies as required.
• Act as a strategic thought partner to senior leaders by advising on emerging threats, evolving regulatory requirements, and industry best practices.

Requirements

• Bachelor’s degree required.
• 10+ years of experience in Information Security.
• 10+ years of experience in IT or Cyber Risk Management.
• Demonstrated experience operating within a Second Line of Defense or independent risk oversight function.
• Strong understanding of cybersecurity control frameworks, including NIST CSF, NIST 800-53, MITRE ATT&CK, ISO 27001, COBIT, and CIS.
• Experience interacting with Boards, regulators, internal audit, and/or executive governance forums.
• Authorized to work in the United States.

Preferred Qualifications

• Relevant professional certifications, such as FAIR, CISSP, CISM, CRISC, or CISA.
• Experience in regulated industries, such as financial services.
• Strong understanding of cloud security, application security, identity and access management, and cyber resilience.
• Familiarity with enterprise risk management methodologies and risk appetite frameworks.

Core Competencies

• Strong analytical and critical thinking skills with the ability to provide constructive challenge.
• Executive-level communication and presentation skills.
• Ability to influence without direct authority.
• Strategic mindset with strong attention to detail.
• High integrity and independent judgment.

Compensation and Benefits

• Salary range: $215,000–$290,000 USD annually, plus benefits and bonus.
• Benefits may include merit increases, incentive compensation for exempt roles, paid holidays, paid time off, medical, dental, vision, short- and long-term disability benefits, 401(k) match, life insurance, and wellness programs.