M&T Bank
Senior Cybersecurity Tech Risk Analyst
M&T Bank, Brainerd, Minnesota, United States, 56401
M&T Bank
With a community bank approach, M&T Bank helps people reach their personal and business goals with banking, mortgage, loan and investment services.Supports a Cybersecurity risk management and governance practice focused on Cybersecurity risk assessments, First Line of Defense and controls testing strategy, development and maintenance of Cybersecurity policies and standards, evaluation of Cybersecurity legal and regulatory requirements, development and execution of the Cybersecurity awareness program, and/or development and execution of the Cybersecurity Risk Management Program.Primary Responsibilities:
Knowledge of IAM governance framework that aligns with industry best practices, regulatory requirements, and organizational policies.Working Knowledge of Role-Based Access Control (RBAC) models, mapping roles and responsibilities to access privileges, segregation of duties (SoD) and least privilege principles and enterprise level IDAM methodologies.Maintain current knowledge of the Bank's Cybersecurity and Risk management policies, standards and procedures as well as industry best practices and proposed new guidelines and regulations.Identify and evaluate Cybersecurity risk to the business and drive development of strategies to mitigate identified risks based on diverse factors including the organizations overall risk appetite and tolerance.Provide current data for key risk indicators (KRIs) and key performance indicators (KPIs). Present results to risk committees. Review current KRI's and KPI's, recommend enhancements to management and present recommendations to risk committees.Understand and adhere to the Company’s risk and regulatory standards, policies and controls in accordance with the Company’s Risk Appetite. Identify risk-related issues needing escalation to management.Promote an environment that supports diversity and reflects the M&T Bank brand.Maintain M&T internal control standards, including timely implementation of internal and external audit points together with any issues raised by external regulators as applicable.Complete other related duties as assigned.Scope of Responsibilities:
This position requires regular interaction with non-management, middle management, certain senior management, and business units and partners. This position also requires occasional interaction with the Chief Information Security Officer.This role is used in one or more of the following ways:
Risk Assessment
Design and develop Cybersecurity risk assessments based on subject matter expertise and industry best practices. Execute risk assessments, analyze results, recommend and implement remediation plans to address defined risks. Present recommendations to area management and various risk committees. Work with other areas of Cybersecurity to define and document controls associated with identified risks.Controls Testing Design
Develop, document and maintain the Bank's Cybersecurity controls testing program and plan. Confirm the program aligns with Cybersecurity policies and standards, Risk Management policies and regulatory requirements.Policy and Standards
Research, recommend, and develop new Cybersecurity policies and standards based on the Bank’s strategic direction and aligned with legal and regulatory requirements and industry best practices. Present recommendations to area management and various risk committees for approval. Update and enhance existing Cybersecurity policies and standards as needed.Regulatory
Review assigned regulatory notifications to identify impact to organization. Discuss results with stakeholders and develop recommendations along with associated action plans to address gaps. Summarize results, recommendations and action plans and present to management and various risk committees. Lead efforts to address action plans.Risk Management Program
Design and develop the Cybersecurity Risk Management program, ensure proper alignment with bank policies and procedures. Analyze program results, recommend enhancements. Present recommendations to area management and various risk committees. Work with other areas of Cybersecurity to define and document key risks and controls.Education and Experience Required:
Associate’s degree and a minimum of 7 years’ relevant work experience, or in lieu of a degree, a combined minimum of 9 years’ higher education and/or work experience, including a minimum of 7 year relevant work experience.Excellent knowledge of Cybersecurity principles relevant to confidentiality, integrity, availability, authentication and non-repudiation.Proven ability facilitating targeted discussions with peers, line managers and senior management within business unit.Experience conducting research and evaluating information for reliability, validity, objectivity and relevance.Excellent ability communicating complex information, concepts or ideas in a confident and well-organized manner through verbal, written and/or visual means.Experience conducting information searches.Excellent ability to discern protection needs (i.e., security controls) of information systems and networks.Proven ability to design and develop effective risk management processes (e.g., methods for assessing and mitigating risk).Experience recognizing vulnerabilities in security systems.Excellent ability designing valid and reliable assessments.Experience conducting knowledge mapping.Experience anticipating new security threats.Education and Experience Preferred:
Bachelor's degree.Certified Information Systems Security Professional (CISSP) or Certified Risk and Information Systems Control (CRISC) certification or Cybersecurity domain-related industry-recognized certification.Knowledge of organization's risk tolerance and/or risk management approach.Knowledge of organizational security policies.Benefits:
Competitive compensationHealth, welfare, and retirement benefits401(k) match at 5%Work-life balance and flexible work arrangementsUp to 25 days PTO plus 12 paid holidaysM&T Bank is committed to fair, competitive, and market-informed pay for our employees. The pay range for this position is $0.00 - $0.00 Annual (USD). The successful candidate’s particular combination of knowledge, skills, and experience will inform their specific compensation. The range listed above corresponds to our national pay range for this role. The specific pay range applicable to you may vary based on your location.Location:
Brainerd, Minnesota, United States of America.
#J-18808-Ljbffr
With a community bank approach, M&T Bank helps people reach their personal and business goals with banking, mortgage, loan and investment services.Supports a Cybersecurity risk management and governance practice focused on Cybersecurity risk assessments, First Line of Defense and controls testing strategy, development and maintenance of Cybersecurity policies and standards, evaluation of Cybersecurity legal and regulatory requirements, development and execution of the Cybersecurity awareness program, and/or development and execution of the Cybersecurity Risk Management Program.Primary Responsibilities:
Knowledge of IAM governance framework that aligns with industry best practices, regulatory requirements, and organizational policies.Working Knowledge of Role-Based Access Control (RBAC) models, mapping roles and responsibilities to access privileges, segregation of duties (SoD) and least privilege principles and enterprise level IDAM methodologies.Maintain current knowledge of the Bank's Cybersecurity and Risk management policies, standards and procedures as well as industry best practices and proposed new guidelines and regulations.Identify and evaluate Cybersecurity risk to the business and drive development of strategies to mitigate identified risks based on diverse factors including the organizations overall risk appetite and tolerance.Provide current data for key risk indicators (KRIs) and key performance indicators (KPIs). Present results to risk committees. Review current KRI's and KPI's, recommend enhancements to management and present recommendations to risk committees.Understand and adhere to the Company’s risk and regulatory standards, policies and controls in accordance with the Company’s Risk Appetite. Identify risk-related issues needing escalation to management.Promote an environment that supports diversity and reflects the M&T Bank brand.Maintain M&T internal control standards, including timely implementation of internal and external audit points together with any issues raised by external regulators as applicable.Complete other related duties as assigned.Scope of Responsibilities:
This position requires regular interaction with non-management, middle management, certain senior management, and business units and partners. This position also requires occasional interaction with the Chief Information Security Officer.This role is used in one or more of the following ways:
Risk Assessment
Design and develop Cybersecurity risk assessments based on subject matter expertise and industry best practices. Execute risk assessments, analyze results, recommend and implement remediation plans to address defined risks. Present recommendations to area management and various risk committees. Work with other areas of Cybersecurity to define and document controls associated with identified risks.Controls Testing Design
Develop, document and maintain the Bank's Cybersecurity controls testing program and plan. Confirm the program aligns with Cybersecurity policies and standards, Risk Management policies and regulatory requirements.Policy and Standards
Research, recommend, and develop new Cybersecurity policies and standards based on the Bank’s strategic direction and aligned with legal and regulatory requirements and industry best practices. Present recommendations to area management and various risk committees for approval. Update and enhance existing Cybersecurity policies and standards as needed.Regulatory
Review assigned regulatory notifications to identify impact to organization. Discuss results with stakeholders and develop recommendations along with associated action plans to address gaps. Summarize results, recommendations and action plans and present to management and various risk committees. Lead efforts to address action plans.Risk Management Program
Design and develop the Cybersecurity Risk Management program, ensure proper alignment with bank policies and procedures. Analyze program results, recommend enhancements. Present recommendations to area management and various risk committees. Work with other areas of Cybersecurity to define and document key risks and controls.Education and Experience Required:
Associate’s degree and a minimum of 7 years’ relevant work experience, or in lieu of a degree, a combined minimum of 9 years’ higher education and/or work experience, including a minimum of 7 year relevant work experience.Excellent knowledge of Cybersecurity principles relevant to confidentiality, integrity, availability, authentication and non-repudiation.Proven ability facilitating targeted discussions with peers, line managers and senior management within business unit.Experience conducting research and evaluating information for reliability, validity, objectivity and relevance.Excellent ability communicating complex information, concepts or ideas in a confident and well-organized manner through verbal, written and/or visual means.Experience conducting information searches.Excellent ability to discern protection needs (i.e., security controls) of information systems and networks.Proven ability to design and develop effective risk management processes (e.g., methods for assessing and mitigating risk).Experience recognizing vulnerabilities in security systems.Excellent ability designing valid and reliable assessments.Experience conducting knowledge mapping.Experience anticipating new security threats.Education and Experience Preferred:
Bachelor's degree.Certified Information Systems Security Professional (CISSP) or Certified Risk and Information Systems Control (CRISC) certification or Cybersecurity domain-related industry-recognized certification.Knowledge of organization's risk tolerance and/or risk management approach.Knowledge of organizational security policies.Benefits:
Competitive compensationHealth, welfare, and retirement benefits401(k) match at 5%Work-life balance and flexible work arrangementsUp to 25 days PTO plus 12 paid holidaysM&T Bank is committed to fair, competitive, and market-informed pay for our employees. The pay range for this position is $0.00 - $0.00 Annual (USD). The successful candidate’s particular combination of knowledge, skills, and experience will inform their specific compensation. The range listed above corresponds to our national pay range for this role. The specific pay range applicable to you may vary based on your location.Location:
Brainerd, Minnesota, United States of America.
#J-18808-Ljbffr