Cyber Business Risk Officer
Charlotte, NC, US, 28202
SMBC Group is a top-tier global financial group. Headquartered in Tokyo and with a 400-year history, SMBC Group offers a diverse range of financial services, including banking, leasing, securities, credit cards, and consumer finance. The Group has more than 130 offices and 80,000 employees worldwide in nearly 40 countries. Sumitomo Mitsui Financial Group, Inc. (SMFG) is the holding company of SMBC Group, which is one of the three largest banking groups in Japan. SMFG’s shares trade on the Tokyo, Nagoya, and New York (NYSE: SMFG) stock exchanges.
In the Americas, SMBC Group has a presence in the US, Canada, Mexico, Brazil, Chile, Colombia, and Peru. Backed by the capital strength of SMBC Group and the value of its relationships in Asia, the Group offers a range of commercial and investment banking services to its corporate, institutional, and municipal clients. It connects a diverse client base to local markets and the organization’s extensive global network. The Group’s operating companies in the Americas include Sumitomo Mitsui Banking Corp. (SMBC), SMBC Nikko Securities America, Inc., SMBC Capital Markets, Inc., JRI America, Inc., SMBC Leasing and Finance, Inc., Banco Sumitomo Mitsui Brasileiro S.A., and Sumitomo Mitsui Finance and Leasing Co., Ltd.
Role Description
The Cyber Business Risk Officer (CBRO) serves as the strategic risk partner between Cybersecurity and assigned business and technology organizations, providing an integrated view of cybersecurity risk, remediation, governance, and business impact.
The role is responsible for translating cybersecurity risk into actionable business priorities, establishing effective governance and reporting, and driving transparency and accountability for risk reduction. The Cyber Business Risk Office will partner with Cyber GRC to help the business lines, group companies, and technology teams prioritize and focus on the most impactful cyber risk reduction activities.
The CBRO brings together risk insight, business context, metrics, governance, and execution to enable informed leadership decisions and demonstrate measurable risk reduction.
Role Objectives
Cyber Risk Leadership
• Serve as the senior cybersecurity risk partner to assigned CIO and business organizations.
• Develop a holistic view of cybersecurity risk across the organization, connecting technical findings with business impact and strategic priorities.
• Identify material and emerging cyber risks and ensure appropriate visibility, escalation, ownership, and governance.
• Facilitate risk-based prioritization of cybersecurity investments and remediation activities.
• Promote consistent cybersecurity risk-management practices across organizational boundaries.
Governance & Executive Reporting
• Establish and lead governance forums that provide leadership visibility into cybersecurity risk, remediation, and strategic priSorities.
• Develop executive-level cyber risk reporting that clearly communicates exposure, trends, remediation progress, decisions, and areas requiring leadership attention.
• Provide leadership with actionable insights rather than activity-based reporting.
• Establish clear accountability for cybersecurity risks, decisions, and remediation outcomes.
• Support executive, committee, regulatory, and other governance reporting as required.
Risk & Remediation Oversight
• Maintain visibility of significant cyber risks, control gaps, findings, exceptions, and remediation commitments.
• Challenge remediation strategies, priorities, target dates, and risk disposition where appropriate.
• Monitor remediation performance and identify systemic issues, dependencies, and barriers affecting risk reduction.
• Escalate material risks and remediation concerns through appropriate governance channels.
• Measure and communicate remediation outcomes and demonstrated risk reduction.
Role Objectives
Business & Technology Partnership
• Act as a trusted advisor to CIO, Cyber, Risk, and business leadership.
• Translate technical cybersecurity issues into clear business risk and decision points.
• Establish regular Cyber Business Risk touchpoints with technology and business organizations.
• Connect cybersecurity strategy and requirements with technology transformation, business priorities, and operational realities.
• Foster collaboration across Cyber, Technology, Enterprise Risk, Internal Audit, and other control functions while maintaining appropriate ownership boundaries.
Metrics, Analytics & Risk Transparency
• Develop meaningful metrics, KRIs, dashboards, and executive reporting that provide transparency into cybersecurity posture.
• Identify trends, concentrations of risk, recurring control issues, and areas requiring leadership intervention.
• Establish mechanisms to measure the effectiveness and outcomes of cyber risk-reduction initiatives.
• Drive consistency and quality in cyber risk data used for leadership decisions.
• Use metrics and analytics to move cyber risk conversations from activity and issue counts to exposure, accountability, and outcomes.
Strategic Risk & Transformation
• Assess cybersecurity implications of significant technology and business transformation initiatives.
• Provide risk insight for strategic decisions, investments, operating-model changes, and major programs.
• Identify emerging risks arising from changes in technology, threat landscape, business strategy, third parties, and operating environments.
• Help ensure cyber transformation initiatives translate into sustainable improvements in risk posture.
Qualifications and Skills
Required
• Significant experience in cybersecurity, technology risk, operational risk, information security, technology governance, or related disciplines.
• Demonstrated ability to operate with senior Cyber, Technology, Risk, and business executives.
• Strong understanding of cybersecurity risk management, controls, governance, and remediation.
• Experience developing executive-level risk reporting, governance forums, metrics, and management insights.
• Ability to translate complex cybersecurity issues into concise business implications and decision points.
• Strong analytical, communication, stakeholder-management, and executive-influencing capabilities.
• Demonstrated experience leading across organizational boundaries without relying solely on direct authority.
Preferred
• Experience within a complex, highly regulated, global organization.
• Familiarity with established cybersecurity and risk frameworks such as NIST Cybersecurity Framework, ISO 27001, COBIT, or equivalent.
• Experience with regulatory examinations, internal audit, control assessments, technology transformation, or enterprise risk management.
• Relevant professional certifications such as CISSP, CISM, CRISC, or comparable risk/security credentials.
SMBC’s employees participate in a Hybrid workforce model that provides employees with an opportunity to work from home, as well as, from an SMBC office. SMBC requires that employees live within a reasonable commuting distance of their office location. Prospective candidates will learn more about their specific hybrid work schedule during their interview process. Hybrid work may not be permitted for certain roles, including, for example, certain FINRA-registered roles for which in-office attendance for the entire workweek is required.
SMBC provides reasonable accommodations during candidacy for applicants with disabilities consistent with applicable federal, state, and local law. If you need a reasonable accommodation during the application process, please let us know at accommodations@smbcgroup.com.
Nearest Major Market: Charlotte