As a key contributor to Truist’s second-line-of-defense (LoD2) Technology Risk function, you will provide independent risk oversight for Security Defense Risk domains. This role strengthens technology governance across cybersecurity defense, detection, incident response, and related controls, partnering with Protection Services and business units to support business outcomes.
This position is based in Raleigh, NC with an onsite work arrangement, and it supports a 1st shift schedule. The target annual base salary is USD 185,000 - 230,000, with regular employment status.
What you’ll do
- Deliver independent risk oversight (LoD2) for Truist Protection Services and related consult to Truist Business Units by identifying, mitigating, monitoring, and reporting technology risk and related risks (including operational and compliance) across Enterprise Technology.
- Act as a subject matter expert and steward of the Cybersecurity Risk Framework, focusing on cybersecurity defense, detection, incident response, and supporting security capabilities.
- Perform independent assessment and oversight of the maturity and adequacy of cybersecurity controls to support business outcomes for performance, stability, security, and service availability across detection, investigation, response, and recovery.
- Support and reinforce a proactive risk culture through risk-focused management and partnership routines with technology teams and internal partners, including interface with senior leaders and key partners.
- Review and challenge outcomes of first-line-of-defense risk program execution.
- Monitor legal, regulatory, compliance, and audit matters for assigned Enterprise Technology oversight areas and ensure timely action.
- Lead complex projects with broad technology and enterprise-level impact, including implications and/or resource requirements beyond risk management, and provide informal leadership to others as a resource for complex solutions.
- Operate effectively in interdisciplinary, matrix environments, using strong cybersecurity technical acumen to bridge risk, business, technology, and cybersecurity functions, shifting between advisory and implementation consulting approaches.
What you bring
- Bachelor’s Degree or an equivalent combination of education and experience.
- 10+ years of banking, technology, operations, or risk management experience.
- Strong business acumen, management experience, and skills in problem solving, critical thinking, influencing, and decision-making.
- Ability to operate independently, navigate ambiguity, and deliver value.
- Excellent interpersonal and communication skills, with demonstrated ability to establish credibility across management levels.
- Proven capability to organize and manage complex initiatives and produce high-quality executive-level work products.
- Comfort working with data and applying analysis to generate value-add insights.
- Adept with Microsoft Office products.
- Master’s degree in Cybersecurity, Computer Science, Information Security, Engineering, Risk Management, or a related discipline.
- Familiarity with financial services cybersecurity laws, regulations, supervisory guidance, and industry standards such as FFIEC IT Examination Handbook, NIST Cybersecurity Framework, NIST SP 800-61, ISO/IEC 27001, and CIS Critical Security Controls.
- Familiarity with risk measurement approaches, including developing Key Risk Indicators and thresholds and reporting/analytics tools (e.g., Tableau).
- Familiarity with enterprise GRC platforms and tools (e.g., RSA Archer).
- Professional cybersecurity certification such as CISM or CISSP or another relevant cybersecurity designation.
- Extensive technical cybersecurity experience, preferably in security operations, incident response, threat detection, threat hunting, digital forensics, or cyber incident management.
Tools and technologies
- Microsoft Office
- FFIEC IT Examination Handbook
- NIST Cybersecurity Framework
- NIST SP 800-61
- ISO/IEC 27001
- CIS Critical Security Controls
- Tableau
- RSA Archer
- Key Risk Indicators
- Certified Information Security Manager (CISM)
- Certified Information Systems Security Professional (CISSP)
Benefits
- Medical, dental, vision, life insurance
- Disability
- Accidental death and dismemberment
- Tax-preferred savings accounts
- 401k plan
- No less than 10 days of vacation (prorated based on date of hire and full-time or part-time status) during their first year
- 10 sick days (also prorated)
- Paid holidays
- Eligibility for Truist defined benefit pension plan, restricted stock units, and/or a deferred compensation plan (depending on position and division)
Language fluency: English (Required).
Regular employment: Regular.
Location: Raleigh, NC (onsite).
Pay transparency (Virginia locations only): $185,000 - $230,000 annual base salary.
