Risk Treatment

GRC Issue Management VP

SMBC is seeking an experienced Cyber Governance, Risk and Compliance professional with 7+ years of experience in Cybersecurity, Information Security, Risk Management, Audit, Regulatory Compliance, and Issue Management. The successful candidate will possess a strong understanding of cybersecurity governance practices, issue remediation, audit management, control validation, and executive reporting within a complex financial services environment.

This role will serve as a key leader within the Risk Treatment Team (RTT), responsible for driving Cybersecurity's Issue Management and Closure Program. The individual will oversee the lifecycle management of audit, regulatory, and self-identified issues from issue intake and creation through remediation validation and closure. Working closely with Issue Owners, Subject Matter Experts (SMEs), Internal Audit, and Regulatory stakeholders, the role will ensure remediation activities are adequately documented, evidence packages meet validation expectations, and issues are closed in a timely and sustainable manner.

A primary responsibility of this position is to establish strong governance, reporting, and tracking mechanisms that provide transparency into issue status, closure performance, remediation progress, and emerging risks. The successful candidate will develop executive-level reporting for the CISO and Cybersecurity leadership team, monitor issue closure trends, identify obstacles to successful remediation, and escalate issues that are at risk of missing commitments, failing validation reviews, or requiring management intervention.

The role will also be responsible for driving consistency across issue management processes, improving closure quality, strengthening accountability among stakeholders, and ensuring risks associated with delayed or ineffective remediation are appropriately escalated and managed. This position reports to the Head of Risk Treatment within Cyber Governance, Risk and Compliance and offers the opportunity to lead a critical function supporting Cybersecurity's risk reduction and control improvement objectives.

Issue Management & Closure Governance

• Lead Cybersecurity's Issue Management and Closure Program, establishing governance, processes, standards, and procedures for the end-to-end management of audit, regulatory, and self-identified issues.
• Oversee the full issue lifecycle including issue intake, issue creation, remediation tracking, validation, closure approval, and post-closure reporting.
• Coordinate closure activities across Issue Owners and SMEs, ensuring remediation evidence and supporting documentation meet Internal Audit, Regulatory, and Risk Management validation expectations.
• Provide effective challenge and quality assurance over remediation evidence packages, ensuring closure requests are complete, sustainable, and supported by sufficient documentation.

Audit and Stakeholder Management

• Serve as the primary liaison between Cybersecurity, Internal Audit, and issue owners, coordinating remediation responses, closure evidence submissions, validation activities, and resolution of audit feedback.
• Organize and manage audit responses and remediation documentation, ensuring timely delivery, consistency, quality, and accountability across stakeholders.
• Facilitate issue validation reviews by coordinating evidence collection, SME engagement, audit inquiries, and closure support activities.

Reporting, Metrics, and Executive Communication

• Identify and escalate issues at risk of missing remediation commitments, failing validation reviews, or experiencing significant implementation delays.
• Drive governance and accountability forums to review remediation progress, closure blockers, validation challenges, and corrective actions.
• Ensure appropriate escalation of issue management risks to Cybersecurity leadership, Issue Owners, Risk Management, and relevant governance committees.

Continuous Improvement

• Enhance issue management processes, reporting capabilities, and closure validation practices to improve efficiency, transparency, and effectiveness across the Cybersecurity organization.
• Define business requirements and support implementation of issue management tooling, including workflow automation, evidence repositories, dashboards, metrics, and reporting solutions.
• Develop and maintain issue management procedures, standards, and lessons learned, promoting consistency and continuous improvement of remediation and closure activities.

Qualifications and Skills

• 7+ years of experience in Cybersecurity, IT Audit, Risk Management, Issue Management, Regulatory Compliance, or Control Governance.
• Demonstrated experience managing audit findings, regulatory issues, remediation programs, and closure validation activities within the financial services industry.
• Strong understanding of remediation governance, issue lifecycle management, audit practices, and evidence validation requirements.
• Experience partnering with Internal Audit, Risk Management, and business stakeholders to drive issue resolution and sustainable remediation.
• Strong analytical and reporting skills with experience developing executive-level dashboards and management reporting.
• Proven ability to manage multiple stakeholders, enforce accountability, and escalate risks requiring leadership attention.
• Experience with governance, risk, compliance, audit, and issue management platforms and reporting solutions.

Additional Requirements