Principal, Cyber Sec IT RiskM

Northern Trust Technology Risk & Control function is responsible for enabling Global Information Technology to build a strong 1st Line of Defense, foster a control aware culture, deliver compliant and secure technology capabilities, protect customers and meet regulatory requirements. The Principal cybersecurity risk and control officer is part of the InfoSec & Infrastructure Control Officer’s Team, responsible for leading risk and control assessments for core cyber & infrastructure security domains, performing security testing, and evaluating compliance to information security policies and procedures and regulatory requirements. You will work directly with cyber security and infrastructure teams providing guidance to implement defense-in-depth controls to protect Northern Trust and the customers. You will work with a dynamic team and contribute to the overall cyber security of the firm.  

Major Duties include but not limited to;  

• Lead risk and control assessments for core cybersecurity/tech domains, including vulnerability management, threat management, third-party security due diligence, identity and access management, endpoint etc. 

• Provide technical expertise to assist the development and maintenance of cyber security standards in line with industry best practices, as well as technical expertise around security threats & vulnerabilities and software security testing 

• Coordinate remediation of cyber security and infrastructure related findings from various sources 

• Assist in development and implementation of cyber security and infra trainings for technical domains 

• Participate in Tech/Cyber incident responses to provide guidance related to tech risks and control assurance 

• Influence behaviors to resolve conflicts, clarify goals and outcomes, and foster a strong technology risk management culture with information security organization 

Qualifications 

Knowledge /Skills/Abilities/Experience & Desirable Criteria include but not limited to; 

• 12+ years of technical or audit experience in core tech and cyber security fields such vulnerability / threat management, Pen-Testing, IAM, Data Protection, IH / IR, AppSec, Network Defense./Security, System Administrator, GRC etc 

• Expert knowledge of performing risk management based on NIST 800-53. 

• Experience in determining vulnerability risk impact on key objectives and critical processes; ability to link risk management programs and initiatives to inform critical business strategies and processes. 

• Excellent analytical ability, consultative and communication skills 

• Applicable industry standard certification(s) preferred 

• Bachelor degree in Computer Science or a related discipline and technical experience in the security aspects of multiple platforms, operating systems, software, communications and network protocols or an equivalent combination of education and work experience