Cyber Security Technical Advisor (GRC) – AVP

Do you want your voice heard and your actions to count?

Discover your opportunity with Mitsubishi UFJ Financial Group (MUFG), the 7th largest financial group in the world. Across the globe, we’re 120,000 colleagues, striving to make a difference for every client, organization, and community we serve. We stand for our values, building long-term relationships, serving society, and fostering shared and sustainable growth for a better world.

With a vision to be the world’s most trusted financial group, it’s part of our culture to put people first, listen to new and diverse ideas and collaborate toward greater innovation, speed and agility. This means investing in talent, technologies, and tools that empower you to own your career.

Join MUFG, where being inspired is expected and making a meaningful impact is rewarded.

The selected colleague will work at an MUFG office or client sites four days per week and work remotely one day. A member of our recruitment team will provide more details.

Job Summary:

This role is a member of the CISO of America’s team and will provide leadership and support within the Cybersecurity GRC function to ensure measurement and enforcement of Information Security requirements, implementation and maintenance of policies, standards, and a comprehensive controls framework ensuring technical systems and information assets are appropriately protected. Scope includes, but is not limited to:

Responsibilities:

• Interact with internal and external teams across various levels within the organization, Audit & IT Controls teams, internal risk committees, and external state and federal agencies (e.g., OCC, FRB).
• Maintain a high degree of knowledge with current and proposed security changes impacting regulatory, privacy and security industry best practice guidance, leveraging technological solutions to meet enterprise needs.
• Drive implementation, sustainability, and maturity of the firm’s Information Security control framework.
• Experienced with benchmark technology process execution against industry standards such as, NIST 800-53, NIST CSF, Federal Financial Institutions Examination Council (FFIEC) CAT, CRI Profile, CIS Benchmarks, OWASP in conjunction with MUFG policies and standards
• Assess control design, operating effectiveness, and sustainability in support of Information Security commitments to align with all applicable laws, regulations, internal policies, and procedures.
• Ensure gaps are addressed via remediation plans with timely resolution which address root cause of control failures.
• Compile and distribute program level reporting to relevant stakeholders.
• Support Information Security oversight and governance by ensuring our control environment is monitored through relevant KRI/KPIs
• Establish and drive a clear risk picture to the lines of business through daily contact on risk and security issues.
• Provide clear and consistent communications to lines of business related to cybersecurity related topics. Guide the lines of business through assessments, translating the technology/security questions so that they can be understood by the business; then guide them as to how to gather the required information.

Qualifications:

• Minimum of 5 years' experience in a combination of risk management, information security and IT roles
• Experienced with a focus on executing information security risk assessment/testing methodologies, evaluating the adequacy and efficiency of internal controls; and identifying issues resulting from internal and/or external compliance examinations.
• Experience with process documentation and designing/executing control test scripts.
• Knowledge of domestic and international banking regulations (Reg W, Basel II, Federal Financial Institutions Examination Council (FFIEC), General Data Protection Regulation (GDPR), etc.) and experience with enforcement agencies oversight activities (regulatory examinations, matters requiring attention (MRAs), consent orders, etc.) within a global systemically important financial institution's information technology and information security environments
• Understanding of the regulatory environment and regulations related to technology risk, and Office of the Comptroller of the Currency (OCC) and Federal Reserve Board (FRB) expectations.
• Professional certifications such as Certified Information System Auditor (CISA), Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Manager (CISM), Certified in the Governance of Enterprise Information Technology (CGEIT), CSX, Certified Information Systems Security Professional (CISSP)
• Ability to constructively work both independently and in collaborative environments involving all l