Key Responsibilities

• Hands-On GRC Leadership: Serve as a hands-on, working leader who personally performs and owns key GRC deliverables — risk assessments, control reviews, regulatory analysis, and reporting — while leading the function across regulatory compliance, technology risk, cyber risk, third-party risk, AI governance, awareness, and policy and standards

• Regulatory Obligations (CFIUS): Manage key regulatory obligations tied to CFIUS, including national security agreement and data security plan commitments

• NYDFS Cybersecurity Compliance: Support NYDFS cybersecurity compliance in partnership with internal subject matter experts and broader risk and compliance stakeholders

• IT & Cyber Risk Management: Oversee IT and cyber risk registers, risk assessments, remediation tracking, findings management, and governance reporting through Optro (formerly AuditBoard)

• Third-Party Cyber Risk: Lead third-party cyber risk management, including vendor due diligence, supplier risk partnership, SOC/SIG review, and cyber-related audit response

• AI Governance: Govern the AI risk management framework, including policy, standards, council activity, risk review, and governance maturity

• Control Library & NIST Alignment: Manage and maintain a technology control library to support clear ownership and accountability and to report on the effectiveness of NIST-aligned controls across the organization

• Education & Awareness: Oversee cybersecurity education, awareness, communications, phishing simulations, testing, metrics, and reporting

• Disaster Recovery Governance: Provide governance oversight for disaster recovery, including plan readiness, testing expectations, and accountability tracking

• Cross-Functional Partnership: Partner across Legal, Privacy, Compliance, Enterprise Risk, Internal Audit, IT, Cybersecurity, Supplier Risk, and business leadership to drive practical risk management

Education & Experience

The requirements listed below are representative of the knowledge, skill and/or ability required.  Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

• Senior cybersecurity GRC, technology risk, cyber risk, information security governance, or regulatory compliance leadership experience

• Background in insurance, financial services, banking, brokerage, or another highly regulated enterprise environment

• Prior experience working directly with a CISO, CIO, or senior information security executive

• Strong understanding of cyber governance, IT and cyber risk registers, regulatory compliance, control environments, audit readiness, and remediation tracking

• Experience with third-party cyber risk, vendor due diligence, supplier risk partnership, and customer/carrier audit response

• Experience with GRC platforms such as AuditBoard/Optro, Archer, ServiceNow IRM/GRC, MetricStream, LogicGate, OneTrust, or similar tools

Certifications, Licenses, Registrations

• Certifications such as CISM, CISSP, CRISC, CISA, GSLC, or similar are preferred

Functional Skills

• Strong executive communication skills, with the ability to simplify complex cyber, technology, regulatory, and operational risk topics for senior leadership

• Ability to lead emerging technology governance, particularly AI governance, policy, standards, risk review, and control development

• Ability to manage executive stakeholders while providing the team clear direction, prioritization, and support

• Proven ability to ensure cybersecurity, technology, and regulatory risks are identified, documented, escalated, remediated, and communicated across the enterprise

Preferred Attributes

• NYDFS cybersecurity experience is strongly preferred

• CFIUS experience is highly valuable