Role Description
Reporting to the VP, Cyber Resilience, this Associate role resides within the Cyber Resilience team in the SMBC Americas Division Information Security Office. The role supports the identification, assessment, and communication of cyber, technology, and operational resilience risks associated with emerging technologies, including artificial intelligence, automation, cloud services, third-party platforms, and evolving threat modeling capabilities.
The Emerging Tech, Risk and Threat Analyst Associate will support day-to-day activities across threat modeling, emerging technology risk analysis, control mapping, issue documentation, and stakeholder reporting. The role will help evaluate how new technologies introduce or change threat scenarios, dependencies, attack surfaces, misuse cases, and resilience considerations across important business services, applications, infrastructure, vendors, and technology processes.
The ideal candidate is analytical, detail-oriented, and comfortable working across cybersecurity, technology risk, architecture, and business stakeholders. The candidate should be able to learn new technical domains quickly, document risk-relevant observations clearly, and translate technical concepts into practical risk language for both technical and non-technical audiences.
Role Objectives
• Support the execution of threat modeling and emerging technology risk assessments across applications, platforms, business services, and third-party technology solutions.
• Analyze emerging technology use cases, including AI/LLM-enabled capabilities, automation, cloud services, APIs, data integrations, and security tooling, to identify relevant threat scenarios and risk themes.
• Assist in documenting assets, data flows, trust boundaries, dependencies, threat agents, attack paths, control coverage, and residual risks.
• Support risk analysis for AI and LLM-related scenarios, including prompt injection, data leakage, model misuse, excessive agency, insecure integrations, insecure outputs, and third-party dependency risks.
• Help maintain threat modeling evidence, assessment workpapers, issue documentation, and reporting artifacts in approved program repositories and tools.
• Partner with application, architecture, infrastructure, information security, technology risk, and business stakeholders to collect assessment information and validate findings.
• Support mapping of identified risks and controls to relevant frameworks, standards, and internal control taxonomies, such as NIST, ISO, OWASP, MITRE, and internal cyber resilience/control frameworks.
• Assist in preparing concise reports, summaries, dashboards, and briefing materials that communicate assessment scope, key risks, control observations, open questions, and recommended next actions.
• Track action items, enhancement opportunities, and issue remediation activities identified through threat modeling or emerging technology risk reviews.
• Monitor emerging cybersecurity and technology risk trends, including AI security, adversarial use of automation, cloud security, API abuse, supply chain risk, and sector-relevant threat activity.
• Support process improvement by helping refine templates, playbooks, taxonomies, questionnaires, and repeatable assessment procedures.
• Contribute to cross-functional discussions related to secure adoption of emerging technologies, operational resilience, and risk-informed technology decision-making.
• Maintain awareness of the firm's important business services, critical systems, technology dependencies, and third-party relationships to support resilience-focused analysis.
• Perform multiple concurrent assignments while maintaining accuracy, traceability, and clear documentation.
Qualifications and Skills
• 2+ years of experience in cybersecurity, technology risk, information security, operational resilience, audit, application security, architecture, threat intelligence, or a related technology control function.
• Foundational understanding of cybersecurity risk concepts, including threats, vulnerabilities, controls, attack surfaces, compensating controls, and residual risk.
• Working knowledge of threat modeling concepts, secure design principles, SDLC practices, cloud services, APIs, identity and access management, and enterprise technology environments.
• Familiarity with emerging technology risk areas, including AI/LLM systems, automation, data protection, third-party technology platforms, and cloud-based services.
• Ability to analyze technical information, identify risk-relevant patterns, and document findings in a clear, structured, and evidence-based manner.
• Strong written communication skills, including the ability to summarize technical risks for non-technical stakeholders.
• Strong organizational skills with the ability to manage multiple assignments, track open items, and maintain accurate documentation.
• Ability to work effectively in a matrixed environment with technology, cybersecurity, risk, compliance, business, and vendor stakeholders.
• Familiarity with industry frameworks and references such as NIST CSF, NIST SP 800-53, ISO 27001/27002, OWASP Top 10, OWASP LLM Top 10, MITRE ATT&CK, MITRE ATLAS, or similar control/threat frameworks.
• Experience with risk assessment tools, GRC platforms, vulnerability management tools, architecture repositories, diagramming tools, or threat modeling platforms preferred.
• Basic scripting, data analysis, reporting, or workflow automation experience preferred but not required.
• Financial services, regulated industry, consulting, or enterprise technology experience preferred.
• BA/BS in Cybersecurity, Computer Science, Information Systems, Information Technology, Engineering, Business, Risk Management, or equivalent relevant experience.
• Relevant certifications preferred but not required, such as Security+, CySA+, GSEC, GCIH, SSCP, CISA, CRISC, CCSK, cloud fundamentals certifications, or AI/security-focused training.
SMBC's employees participate in a Hybrid workforce model that provides employees with an opportunity to work from home, as well as, from an SMBC office. SMBC requires that employees live within a reasonable commuting distance of their office location. Prospective candidates will learn more about their specific hybrid work schedule during their interview process. Hybrid work may not be permitted for certain roles, including, for example, certain FINRA-registered roles for which in-office attendance for the entire workweek is required.
