Role Description
The Cyber Business Risk Officer (CBRO) serves as the strategic risk partner between Cybersecurity and assigned business and technology organizations, providing an integrated view of cybersecurity risk, remediation, governance, and business impact.
The role is responsible for translating cybersecurity risk into actionable business priorities, establishing effective governance and reporting, and driving transparency and accountability for risk reduction. The Cyber Business Risk Office will partner with Cyber GRC to help the business lines, group companies, and technology teams prioritize and focus on the most impactful cyber risk reduction activities.
The CBRO brings together risk insight, business context, metrics, governance, and execution to enable informed leadership decisions and demonstrate measurable risk reduction.
Role Objectives
Cyber Risk Leadership
• Serve as the senior cybersecurity risk partner to assigned CIO and business organizations.
• Develop a holistic view of cybersecurity risk across the organization, connecting technical findings with business impact and strategic priorities.
• Identify material and emerging cyber risks and ensure appropriate visibility, escalation, ownership, and governance.
• Facilitate risk-based prioritization of cybersecurity investments and remediation activities.
• Promote consistent cybersecurity risk-management practices across organizational boundaries.
Governance & Executive Reporting
• Establish and lead governance forums that provide leadership visibility into cybersecurity risk, remediation, and strategic priSorities.
• Develop executive-level cyber risk reporting that clearly communicates exposure, trends, remediation progress, decisions, and areas requiring leadership attention.
• Provide leadership with actionable insights rather than activity-based reporting.
• Establish clear accountability for cybersecurity risks, decisions, and remediation outcomes.
• Support executive, committee, regulatory, and other governance reporting as required.
Risk & Remediation Oversight
• Maintain visibility of significant cyber risks, control gaps, findings, exceptions, and remediation commitments.
• Challenge remediation strategies, priorities, target dates, and risk disposition where appropriate.
• Monitor remediation performance and identify systemic issues, dependencies, and barriers affecting risk reduction.
• Escalate material risks and remediation concerns through appropriate governance channels.
• Measure and communicate remediation outcomes and demonstrated risk reduction.
Role Objectives
Business & Technology Partnership
• Act as a trusted advisor to CIO, Cyber, Risk, and business leadership.
• Translate technical cybersecurity issues into clear business risk and decision points.
• Establish regular Cyber Business Risk touchpoints with technology and business organizations.
• Connect cybersecurity strategy and requirements with technology transformation, business priorities, and operational realities.
• Foster collaboration across Cyber, Technology, Enterprise Risk, Internal Audit, and other control functions while maintaining appropriate ownership boundaries.
Metrics, Analytics & Risk Transparency
• Develop meaningful metrics, KRIs, dashboards, and executive reporting that provide transparency into cybersecurity posture.
• Identify trends, concentrations of risk, recurring control issues, and areas requiring leadership intervention.
• Establish mechanisms to measure the effectiveness and outcomes of cyber risk-reduction initiatives.
• Drive consistency and quality in cyber risk data used for leadership decisions.
• Use metrics and analytics to move cyber risk conversations from activity and issue counts to exposure, accountability, and outcomes.
Strategic Risk & Transformation
• Assess cybersecurity implications of significant technology and business transformation initiatives.
• Provide risk insight for strategic decisions, investments, operating-model changes, and major programs.
• Identify emerging risks arising from changes in technology, threat landscape, business strategy, third parties, and operating environments.
• Help ensure cyber transformation initiatives translate into sustainable improvements in risk posture.
Qualifications and Skills
Required
• Significant experience in cybersecurity, technology risk, operational risk, information security, technology governance, or related disciplines.
• Demonstrated ability to operate with senior Cyber, Technology, Risk, and business executives.
• Strong understanding of cybersecurity risk management, controls, governance, and remediation.
• Experience developing executive-level risk reporting, governance forums, metrics, and management insights.
• Ability to translate complex cybersecurity issues into concise business implications and decision points.
• Strong analytical, communication, stakeholder-management, and executive-influencing capabilities.
• Demonstrated experience leading across organizational boundaries without relying solely on direct authority.
Preferred
• Experience within a complex, highly regulated, global organization.
• Familiarity with established cybersecurity and risk frameworks such as NIST Cybersecurity Framework, ISO 27001, COBIT, or equivalent.
• Experience with regulatory examinations, internal audit, control assessments, technology transformation, or enterprise risk management.
• Relevant professional certifications such as CISSP, CISM, CRISC, or comparable risk/security credentials.
SMBC's employees participate in a Hybrid workforce model that provides employees with an opportunity to work from home, as well as, from an SMBC office. SMBC requires that employees live within a reasonable commuting distance of their office location. Prospective candidates will learn more about their specific hybrid work schedule during their interview process. Hybrid work may not be permitted for certain roles, including, for example, certain FINRA-registered roles for which in-office attendance for the entire workweek is required.
