The position is described below. If you want to apply, click the Apply Now button at the top or bottom of this page. After you click Apply Now and complete your application, you'll be invited to create a profile, which will let you see your application status and any communications. If you already have a profile with us, you can log in to check status.

Need Help?

If you have a disability and need assistance with the application, you can request a reasonable accommodation. Send an email to Accessibility (accommodation requests only; other inquiries won't receive a response).

Regular or Temporary:

Regular

Language Fluency:  English (Required)

Work Shift:

1st shift (United States of America)

Please review the following job description:

The Chief Cybersecurity Risk Officer (CCRO) is a senior executive position responsible for providing comprehensive risk oversight of the organization's cybersecurity organization. Reporting to the Chief Risk Information Officer (CIRO), this role serves as a critical second line of defense function, ensuring effective risk management across cybersecurity, while supporting the institution's strategic objectives.

This role will serve as the Risk Oversight Leader for all functions within Cybersecurity. This role will lead and implement the cyber risk oversight for Truist which includes: 1) Serve as the Chief Cybersecurity Risk Officer with independent oversight and challenge to the Chief Information Security Officer (CISO) for all risk types; 2) Establish and manage cyber risk oversight – inclusive of delivery of independent assessments and continuous monitoring; 3) Provide guidance to senior leaders across the company on critical cybersecurity issues for both internal and external stakeholders; 4) Use judgment to escalate significant issues and emerging risks; communicate cyber domain maturity and residual risk to senior management including up to the Board of Directors; 5) consistently and appropriately apply second line of defense corporate authority for managing Truist’s cyber risk.

Essential Duties and Responsibilities

Following is a summary of the essential functions for this job.  Other duties may be performed, both major and minor, which are not mentioned below.  Specific activities may change from time to time. 

1. Strategic Leadership - Develop and maintain the enterprise technology management framework, incorporating emerging risks related to cyber security.  Establish risk appetite statements, key risk indicators, and thresholds for cyber security across the organization.  Provide independent assessment and challenge of cyber security initiatives, ensuring alignment with risk appetite and regulatory expectations. Lead the evaluation of strategic cyber security decisions and their impact on the organization's risk profile.

2. Risk Leadership - Provide independent risk oversight (i.e., second line of defense/LOD2) for Truist Protection Services (TPS) through the effective identification, mitigation, monitoring and reporting of operational, technology and compliance related risks within Core Technology and Cyber.  This role includes independently challenging LOD1 self-assessments and providing effective challenges of CCS to ensure applicable risk types remain within our stated risk appetite.

Additionally, this role is responsible for integrating and aligning all cybersecurity risk with business unit risk, controls and assessments. Work in conjunction with other Risk Oversight Officers (RCSA, IRM, MRMD etc.) to ensure a common set of requirements in establishing a comprehensive risk management approach & transparent decision making and prioritization of technology activities.

3. Governance and Oversight - Serve as a non-voting member of the first line owned Technology, Data and Operations risk committee, a voting member of the CIRO led risk committee and actively participate in the Enterprise and Board Risk Committees (BRC) This includes (a) reviewing and effectively challenging technology and data risk policies, standards, and procedures, (b) overseeing the assessment and monitoring of critical technology vendors and third-party service providers, and (c) ensuring compliance with regulatory requirements and supervisory guidance related to cybersecurity risk.

4. Risk Assessments - Define, communicate