Lead, Cybersecurity GRC & Risk Management

About Northern Trust

As a global leader in innovative wealth management asset servicing asset management and banking services Northern Trust (Nasdaq: NTRS) is proud to guide the worlds most successful individuals families corporations and institutions.

Since 1889 we have aligned our efforts with our three guiding Principles That Endure: Service Expertise and Integrity. Together they reflect the three cornerstones of business conduct which we strive to instill in our employees whom we call partners and to provide to our clients and the communities we serve worldwide.

With more than 135 years of financial experience and over 24000 partners we serve the worlds most sophisticated clients using leading technology and exceptional service.

Summary

Northern Trust Technology Cybersecurity GRC function is responsible for enabling Global Cybersecurity to strong 1stLine of Defense foster a control aware culture deliver compliant and secure technology capabilities protect customers and meet regulatory Lead role is part of the Cybersecurity GRC Team responsible for leading and supporting risk and control assessments for core cyber security domains performing security testing and evaluating compliance to information security policies and procedures and regulatory requirements. The role will work directly with cybersecurity Infrastructure and business units teams providing guidance to implement defense-in-depth controls to protect Northern Trust and the customers. As well as working with a dynamic team and contributing to the overall cyber security of the firm.

Major Duties include but not limited to;

• Advise and support risk and control assessments for core cyber security domains
• Lead remediation of cyber security findings from various sources
• Solves problems and timely management of open risk and control gaps
• Support the development and maintenance of cyber security standards in line with industry best practices as well as support technical engagements around security threats & vulnerabilities and software security testing

Knowledge /Skills/Abilities/Experience & Desirable Criteria include;

• Strong knowledge across core cybersecurity domains including IAM Data Protection Vulnerability Management Threat Management Incident Response Application Security Network Security Cloud Security and Cyber GRC.
• Good understanding of regulatory requirements and frameworks including CHIPS CHAPS and FRB-related requirements.
• Strong knowledge of cybersecurity and risk management frameworks including NIST CSF NIST RMF CRI Profile and APQC.
• Thorough understanding of Issue Management and remediation processes including identification assessment tracking validation and closure of control gaps.
• Experience in mapping cybersecurity controls to risks Issues/IPTs regulatory requirements industry frameworks and internal policies/procedures.
• Strong knowledge of cybersecurity control testing and audit methodologies including control design and operating effectiveness assessments risk identification and gap analysis.
• Experience working across the 2nd and/or 3rd Lines of Defense particularly in control testing independent validation and audit activities.
• Knowledge and experience in conducting cybersecurity maturity assessments and identifying improvement opportunities.
• Good understanding of Cloud Security risks controls and governance requirements.
• Strong evidence analysis and validation skills including the ability to assess evidence against control descriptions Issues/IPTs policies procedures and regulatory requirements.
• Technical or audit experience in core cyber security fields such as vulnerability / threat management Pen-Testing IAM Data Protection IH / IR AppSec Network Security System Administrator GRC
• Understanding of Controls across Cybersecurity domains
• Knowledge of performing risk management and industry standards NIST etc.
• Ability to proactively assess issues identify solutions and problem solve.
• Ability to understand and interact with technology subject matter experts regarding technology topics
• Analytical consultative and communication skills with ability to communicate control requirements to partners in terms easily understood
• Organized and time management skills with ability to produce high-quality timely deliverables
• Flexible approach towards changing work methods deadlines and variable workloads.
• Ability to adapt and react timely and positively in a changing and dynamic work environment.
• Expertise in Microsoft Office Suite and ability to learn new tools as needed.
• Applicable industry standard certification(s) desired
• Bachelors degree in computer science or a related discipline and technical experience in the security aspects of multiple platforms operating systems software communications and network protocols or an equivalent combination of education and work experience

Major Duties:

• Provides consultative support best practice guidance and support to internal/external teams to Cybersecurity Technology and Business Units staff in risk assessments implement.
• Identifies evaluates conducts schedules and leads technical analyses functions to ensure all applicable Cybersecurity requirements are met.
• Participates in the evaluation development implementation communication monitoring and maintenance of Cybersecurity policies and procedures.
• May act as Project Leader with servant leadership approach
• May be involved in helping and training to other specialists and team members on .
• Keeping abreast on the direction of emerging industry standards.
• Provides technical analysis of requirements necessary for the protection of all information processed stored or transmitted by systems.
• Serves as an expert resource or go to person within a group.
• Conduct preliminary analysis.
• Review work of others.
• Handles more extensive high-profile work.
• Responsible for direct interaction with different committees and/or management.
  
  Knowledge:

Is a technical expert with in-depth knowledge in area of expertise and strong knowledge of other areas. Requires excellent analytical ability consultation and communication skills strong judgment and the ability to work effectively with clients IT management and staff vendors and consultants.

Experience:

Bachelors degree in computer science or a related discipline and at least four typically six or more years of technical experience in the security aspects of multiple platforms operating systems software communications and network protocols or an equivalent combination of education and work experience.

Key Responsibilities

• Lead and support risk and control assessments across cybersecurity domains including Identity and Access Management Data Protection Vulnerability Management Threat Management Incident Response Application Security Network Security Cloud Security and Cyber GRC.
• Plan conduct and oversee cybersecurity control evidence collection risk identification evidence validation and control gap analysis.
• Lead the identification assessment tracking validation and closure of cybersecurity issues and control gaps ensuring timely and sustainable remediation.
• Review cybersecurity findings from control testing risk assessments audits regulatory reviews and other assurance activities and work with control owners to develop appropriate remediation strategies.
• Map cybersecurity controls to applicable risks Issues/IPTs regulatory requirements industry frameworks and internal policies and procedures.
• Evaluate evidence against control descriptions documented procedures Issues/IPTs risk statements and regulatory requirements to determine whether controls are appropriately designed and operating effectively.
• Provide technical and risk-management guidance to Cybersecurity Technology Infrastructure Business and IT Management teams regarding control implementation and defense-in-depth security practices.
• Participate in the development implementation communication monitoring and maintenance of cybersecurity policies standards procedures and control requirements.
• Support technical engagements involving security threats and vulnerabilities penetration testing software security testing Cloud Security and other emerging cybersecurity risks.
• Conduct cybersecurity maturity assessments identify capability gaps and recommend practical improvement opportunities aligned with organizational risk appetite and industry practices.
• Serve as a cybersecurity risk and control subject matter expert and act as the primary point of contact for complex or high-profile risk and control matters.
• Lead technical analyses and risk-based reviews to ensure applicable information security and regulatory requirements are appropriately addressed.
• Review the quality and completeness of work performed by team members and provide guidance training and technical assistance to junior specialists.
• Lead or support cybersecurity risk and control projects coordinate activities across multiple stakeholders and ensure timely delivery of high-quality outcomes.
• Prepare and present clear risk assessments control testing results remediation updates and management-level reporting to senior stakeholders and governance committees.
• Maintain awareness of emerging cybersecurity threats regulatory expectations technologies and industry standards and assess their potential impact on the organizations control environment.

Required Knowledge and Skills

• Strong knowledge of cybersecurity domains including IAM Data Protection Vulnerability Management Threat Management Incident Response Application Security Network Security Cloud Security and Cyber GRC.
• Strong understanding of technology risk management cybersecurity controls control testing audit methodologies and design and operating effectiveness assessments.
• Working knowledge of cybersecurity and risk management frameworks including NIST Cybersecurity Framework NIST Risk Management Framework CRI Profile and APQC
• Understanding relevant regulatory requirements including CHIPS CHAPS and FRB-related requirements.
• Experience with issue management and remediation processes including issue identification risk assessment action-plan development tracking validation and closure.
• Experience working within the First Second or Third Line of Defense particularly in cybersecurity control testing independent validation risk management or audit activities.
• Strong analytical and problem-solving skills with the ability to evaluate complex technology risks and recommend practical solutions.
• Excellent consultative stakeholder-management and communication skills with the ability to explain cybersecurity risks and control requirements in clear business language.
• Ability to interact effectively with technical subject matter experts IT management business stakeholders vendors consultants senior management and governance committees.
• Strong organizational and time-management skills with the ability to manage changing priorities variable workloads and multiple deadlines while maintaining high-quality deliverables.
• Strong judgment and the ability to independently manage complex sensitive and high-profile cybersecurity risk matters.
• Proficiency in Microsoft Office applications and the ability to quickly learn and effectively use new risk-management and cybersecurity tools.

Education and Experience

• Bachelors degree in Computer Science Information Technology Cybersecurity or a related discipline or an equivalent combination of education and relevant professional experience.
• Typically six or more years of relevant experience in cybersecurity technology risk management information security control testing audit or related areas.
• Technical or audit experience across multiple platforms operating systems applications communication technologies and network protocols is preferred.
• Relevant industry certifications such as CISA CRISC CISSP CCSP or equivalent cybersecurity risk-management or audit certifications are desirable. The source document requires applicable industry certifications but does not prescribe specific certifications.

Leadership Expectations

The role is expected to operate as a technical expert reviewer project lead and trusted advisor. The individual should be capable of independently handling complex assignments guiding junior team members reviewing the work of others engaging with management and governance committees and influencing stakeholders to improve the organizations cybersecurity risk and control environment.

Working with Us

As a Northern Trust partner you will be part of a flexible and collaborative work culture which has a strong history of financial strength and stability. Movement within the organization is encouraged senior leaders are accessible and you can take pride in working for a company committed to an inclusive workplace and assisting the communities we serve.

Philanthropy is deeply rooted in Northern Trusts history and is an essential element of our culture. Employees around the world give their time and talent to work for the greater good of their communities.

Reasonable Accommodation

Northern Trust is committed to working with and providing adjustments to individuals with health conditions and disabilities. If you need a reasonable accommodation for any part of the employment process please email our HR Service Center at or alternatively you can discuss your individual requirements with the recruiter you are working with.

About Our Pune Office

The Northern Trust Pune office established in 2016 is now home to over 3000 employees. The office handles various functions including Operations for Asset Servicing and Wealth Management as well as delivering critical technology solutions that support business operations across the globe.

Our Pune team takes our commitment to service to 2024 they volunteered more than 10000 hours into the communities where they live and work. Learn more.