Cyber Controls Manager, VP

SMBC Group is a top-tier global financial group. Headquartered in Tokyo and with a 400-year history, SMBC Group offers a diverse range of financial services, including banking, leasing, securities, credit cards, and consumer finance. The Group has more than 130 offices and 80,000 employees worldwide in nearly 40 countries. Sumitomo Mitsui Financial Group, Inc. (SMFG) is the holding company of SMBC Group, which is one of the three largest banking groups in Japan. SMFG’s shares trade on the Tokyo, Nagoya, and New York (NYSE: SMFG) stock exchanges.

In the Americas, SMBC Group has a presence in the US, Canada, Mexico, Brazil, Chile, Colombia, and Peru. Backed by the capital strength of SMBC Group and the value of its relationships in Asia, the Group offers a range of commercial and investment banking services to its corporate, institutional, and municipal clients. It connects a diverse client base to local markets and the organization’s extensive global network. The Group’s operating companies in the Americas include Sumitomo Mitsui Banking Corp. (SMBC), SMBC Nikko Securities America, Inc., SMBC Capital Markets, Inc., SMBC MANUBANK, JRI America, Inc., SMBC Leasing and Finance, Inc., Banco Sumitomo Mitsui Brasileiro S.A., and Sumitomo Mitsui Finance and Leasing Co., Ltd.

JOB SUMMARY

Join SMBC’s Cyber Governance team as Vice President, Cyber Controls Manager. You will lead the Cyber Controls & Regulatory Frameworks function and strengthen how we design, govern, measure, and maintain cybersecurity controls. You will combine hands-on controls expertise with team leadership to simplify a mature program, improve regulatory alignment, and expand continuous controls monitoring.

This role reports to the Head of Cyber Governance and manages one direct report, along with contractors and matrixed resources.

PRINCIPAL DUTIES AND RESPONSIBILITIES

• Own the Cyber Controls Library, including control objectives, descriptions, ownership, applicability, taxonomy, versioning, change governance, rationalization, and retirement.

• Maintain traceable mappings across cyber controls, the NIST Cybersecurity Framework, CRI Profile, regulatory requirements, and internal policies and standards.

• Identify coverage gaps and prepare the program for regulatory reviews.

• Lead key-control analysis and rationalization.

• Apply risk-based criteria to key-control designations and identify opportunities to remove duplication, simplify controls, and strengthen coverage.

• Guide continuous controls monitoring.

• Define and challenge key control indicators, data requirements, measurement methods, RAG thresholds, escalation criteria, and reporting with Cyber Data, Governance Engineering & Automation, and control owners.

• Design and improve controls that address cyber risks, regulatory requirements, policy obligations, audit findings, and identified gaps.

• Conduct targeted quality reviews and assess documentation, evidence, and traceability.

• Develop metrics, dashboards, and executive reporting that clearly communicate control health, trends, risk concentrations, data limitations, and decisions requiring leadership attention.

• Partner with Cyber, Technology, Internal Audit, Risk, Compliance, Operational Resilience, and control owners on inquiries, control challenges, issue interpretation, and sustainable corrective actions.

• Lead one direct report and coordinate contractors or matrixed resources.

• Set priorities, review deliverables, clarify accountability, and improve governance processes through standardization and automation.

POSITION SPECIFICATIONS

• 6+ years of relevant experience in cybersecurity governance, technology or cyber audit, technology risk, controls assurance, first-line controls, operational risk, or a related discipline. Experience must include financial services or another highly regulated environment.

• Experience designing, assessing, challenging, mapping, rationalizing, or governing cybersecurity or technology controls.

• Frameworks and regulation: Working knowledge of the NIST Cybersecurity Framework, CRI Profile, NYDFS Part 500, FFIEC guidance, and relevant Federal Reserve or U.S. banking expectations for cybersecurity and technology risk.

• Cybersecurity: Understanding of key domains such as identity and access management, vulnerability and patch management, logging and monitoring, endpoint and network security, cloud security, data protection, secure development, third-party risk, incident response, and resilience.

• Experience working with Internal Audit, Risk, Compliance, senior leaders, and control owners, including reviewing control design, evidence, gaps, and conclusions.

• Experience leading programs or teams, setting priorities, reviewing detailed work, and delivering complex controls or governance initiatives.

• Strong analytical, written, verbal, facilitation, and presentation skills, including the ability to translate technical and regulatory requirements into clear actions and executive-level reporting.

• Bachelor’s degree or equivalent relevant professional experience.

NICE TO HAVE

• 7+ years of relevant experience, including responsibility for a significant cyber controls, technology risk, audit, regulatory, or governance program.

• Experience in both cyber or technology audit and a first-line risk, controls, or governance function.

• Experience with continuous controls monitoring, including KCIs, control-health metrics, RAG thresholds, monitoring logic, or executive dashboards.

• Knowledge of ISO/IEC 27001, NIST SP 800-53, or international cyber and operational-resilience requirements such as OSFI B-13, DORA, EBA guidance, ECB expectations, or CIMA requirements.

• Experience with an enterprise GRC platform such as SAI360, ServiceNow, Archer, or a comparable platform, and/or a relevant certification such as CISA, CISSP, CISM, or CRISC.

SMBC’s employees participate in a Hybrid workforce model that provides employees with an opportunity to work from home, as well as, from an SMBC office. SMBC requires that employees live within a reasonable commuting distance of their office location. Prospective candidates will learn more about their specific hybrid work schedule during their interview process. Hybrid work may not be permitted for certain roles, including, for example, certain FINRA-registered roles for which in-office attendance for the entire workweek is required.

SMBC provides reasonable accommodations during candidacy for applicants with disabilities consistent with applicable federal, state, and local law. If you need a reasonable accommodation during the application process, please let us know at [email protected].

EOE, including Disability/veterans