Lead, Cybersecurity GRC & Risk Management

About Northern Trust

As a global leader in innovative wealth management, asset servicing, asset management and banking services, Northern Trust (Nasdaq: NTRS) is proud to guide the world’s most successful individuals, families, corporations and institutions.

Since 1889, we have aligned our efforts with our three guiding Principles That Endure: Service, Expertise, and Integrity. Together, they reflect the three cornerstones of business conduct which we strive to instill in our employees, whom we call partners, and to provide to our clients and the communities we serve worldwide.

With more than 135 years of financial experience and over 24,000 partners, we serve the world’s most sophisticated clients using leading technology and exceptional service.

Summary

Northern Trust Technology Cybersecurity GRC function is responsible for enabling Global Cybersecurity to strong 1st Line of Defense, foster a control aware culture, deliver compliant and secure technology capabilities, protect customers and meet regulatory requirements. The Lead role is part of the Cybersecurity GRC Team, responsible for leading and supporting risk and control assessments for core cyber security domains, performing security testing, and evaluating compliance to information security policies and procedures and regulatory requirements. The role will work directly with cybersecurity, Infrastructure and business units’ teams providing guidance to implement defense-in-depth controls to protect Northern Trust and the customers. As well as working with a dynamic team and contributing to the overall cyber security of the firm.

Major Duties include but not limited to;

• •Advise and support risk and control assessments for core cyber security domains
• •Lead remediation of cyber security findings from various sources
• •Solves problems and timely management of open risk and control gaps
• •Support the development and maintenance of cyber security standards in line with industry best practices, as well as support technical engagements around security threats & vulnerabilities and software security testing

Knowledge /Skills/Abilities/Experience & Desirable Criteria include;

• •Strong knowledge across core cybersecurity domains, including IAM, Data Protection, Vulnerability Management, Threat Management, Incident Response, Application Security, Network Security, Cloud Security and Cyber GRC.
• •Good understanding of regulatory requirements and frameworks, including CHIPS, CHAPS and FRB-related requirements.
• •Strong knowledge of cybersecurity and risk management frameworks, including NIST CSF, NIST RMF, CRI Profile and APQC.
• •Thorough understanding of Issue Management and remediation processes, including identification, assessment, tracking, validation, and closure of control gaps.
• •Experience in mapping cybersecurity controls to risks, Issues/IPTs, regulatory requirements, industry frameworks, and internal policies/procedures.
• •Strong knowledge of cybersecurity control testing and audit methodologies, including control design and operating effectiveness assessments, risk identification, and gap analysis.
• •Experience working across the 2nd and/or 3rd Lines of Defense, particularly in control testing, independent validation, and audit activities.
• •Knowledge and experience in conducting cybersecurity maturity assessments and identifying improvement opportunities.
• •Good understanding of Cloud Security risks, controls, and governance requirements.
• •Strong evidence analysis and validation skills, including the ability to assess evidence against control descriptions, Issues/IPTs, policies, procedures, and regulatory requirements.
• •Technical or audit experience in core cyber security fields such as vulnerability / threat management, Pen-Testing, IAM, Data Protection, IH / IR, AppSec, Network Security, System Administrator, GRC
• •Understanding of Controls across Cybersecurity domains
• •Knowledge of performing risk management and industry standards, NIST etc.
• •Ability to proactively assess issues, identify solutions and problem solve.
• •Ability to understand and interact with technology subject matter experts regarding technology topics
• •Analytical, consultative and communication skills with ability to communicate control requirements to partners in terms easily understood
• •Organized and time management skills, with ability to produce high-quality timely deliverables
• •Flexible approach towards changing work methods, deadlines and variable workloads.
• •Ability to adapt and react timely and positively in a changing and dynamic work environment.
• •Expertise in Microsoft Office Suite and ability to learn new tools as needed.
• •Applicable industry standard certification(s) desired
• •Bachelor’s degree in computer science or a related discipline and technical experience in the security aspects of multiple platforms, operating systems, software, communications and network protocols or an equivalent combination of education and work experience

Major Duties :

• •Provides consultative support, best practice guidance and support to internal/external teams to Cybersecurity , Technology and Business Units staff in risk assessments, implement.
• •Identifies, evaluates, conducts, schedules and leads technical analyses functions to ensure all applicable Cybersecurity requirements are met.
• •Participates in the evaluation, development, implementation, communication, monitoring and maintenance of Cybersecurity policies and procedures.
• •May act as Project Leader with servant leadership approach
• •May be involved in helping and training to other specialists and team members on .
• •Keeping abreast on the direction of emerging industry standards.
• •Provides technical analysis of requirements necessary for the protection of all information processed, stored, or transmitted by systems.
• •Serves as an expert resource or ¿go to person¿ within a group.
• •Conduct preliminary analysis.
• •Review work of others.
• •Handles more extensive, high-profile work.
• •Responsible for direct interaction with different committees and/or management.

Knowledge:

Is a technical expert with in-depth knowledge in area of expertise and strong knowledge of other areas. Requires excellent analytical ability, consultation and communication skills, strong judgment and the ability to work effectively with clients, IT management and staff, vendors and consultants.

Experience:

Bachelor’s degree in computer science or a related discipline and at least four, typically six or more years of technical experience in the security aspects of multiple platforms, operating systems, software, communications and network protocols or an equivalent combination of education and work experience.

Key Responsibilities

• •Lead and support risk and control assessments across cybersecurity domains, including Identity and Access Management, Data Protection, Vulnerability Management, Threat Management, Incident Response, Application Security, Network Security, Cloud Security, and Cyber GRC.
• •Plan, conduct, and oversee cybersecurity control evidence collection, risk identification, evidence validation, and control gap analysis.
• •Lead the identification, assessment, tracking, validation, and closure of cybersecurity issues and control gaps, ensuring timely and sustainable remediation.
• •Review cybersecurity findings from control testing, risk assessments, audits, regulatory reviews, and other assurance activities, and work with control owners to develop appropriate remediation strategies.
• •Map cybersecurity controls to applicable risks, Issues/IPTs, regulatory requirements, industry frameworks, and internal policies and procedures.
• •Evaluate evidence against control descriptions, documented procedures, Issues/IPTs, risk statements, and regulatory requirements to determine whether controls are appropriately designed and operating effectively.
• •Provide technical and risk-management guidance to Cybersecurity, Technology, Infrastructure, Business, and IT Managem