Sr. Manager, Information Security - Regulatory & Examination

Sr. Manager, Information Security - Regulatory & Examination

Join to apply for the Sr. Manager, Information Security - Regulatory & Examination role at CIBC US.

Location: IL-70 W Madison St, 8th Floor
Employment Type: Regular
Hours: 40 Weekly
Salary: $150,000–$175,000 (market)

• Regulatory Exams
  • End to end exam management
  • Ensure regulatory exam readiness
  • Review and suggest approach (responses, evidence) to regulatory exam letters
  • Coordinate response and evidence collection (including direct response/fulfillment), evaluating and questioning, aligning on strategic messaging, presenting to senior leadership to align on audit ready responses
• Regulatory Remediation
  • Actively engage in regulatory remediation activities, analysis of regulatory feedback, suggesting recommended action, coordinating and evaluating responses, performing remediation actions, preparing regulatory update decks, creating speaking notes, ensuring messaging alignment with internal stakeholders and addressing any post‑meeting follow‑ups.
• Regulatory Briefings
  • Prepare oversight briefing materials, including recommendations on approach/key themes and speaking notes
  • Coordinate follow‑up activities
• Internal Audit
  • Ensure internal teams are prepared for Internal Audit activities
  • Manage and socialize Internal Audit calendar
  • Coordinate audits, including fulfillment and evaluation of responses and evidence provided
  • Escalate potential issues before formal identification
  • Ensure timely review and response to audit reports
  • Oversee creation of new audit‑related deficiencies
  • Serve as point for monthly continuous monitoring
• Program Management - Regulatory Program Compliance
  • Ensure NY DFS program annual activities are completed, including the NY Branch assessment, surveys, with risks identified and actioned
  • Ensure FFIEC/GLBA program activities are completed, including the annual assessment with risks identified and actioned
  • Complete annual Regulatory Control Management activities
  • Complete annual Regulatory Control Requirement Assessment
• Reporting
  • Ensure overall CSO organization regulatory reporting dashboard is delivered
  • Monitor relevant laws, regulations and standards to ensure organization’s security practices align with regulatory requirements; create and distribute monthly regulatory development update reporting.
  • Assist with creation of materials for Annual Cyber Security Board Review and Quarterly Board Risk Committee Meetings
  • Creation of materials for various reporting committees and forums, including weekly status, weekly reports, business unit reviews and horizontal reviews
• Projects
  • Oversee or complete specific enterprise, US region or department initiatives
• General
  • Build strong relationships with internal and external partners, seen by them as a trusted partner
  • Complete ad hoc and urgent requests from internal and external partners, and recommend new controls to reduce risks
  • Work closely with US TI&I Risk & Controls Team, Regulatory Affairs, Operational Risk Management (ORM) and Internal Audit as required.
  • Teamwork and Relationship Building – Foster collaborative relationships with a wide range of stakeholders to identify opportunities to enhance Information Security processes and controls, understand pain‑points and priorities, influence direction, solve problems, and ensure successful adoption and operation of policies and standards.
  • Will be required to foster relationships with middle to senior management, and senior executives across a range of functions including Risk Management and Technology.
  • Share governance best practices, based on regulatory and audit observations and feedback identified
  • Provides ongoing advice and direction on a variety of complex conceptual or interpretative issues
  • Perform regulatory controls as assigned control performer
  • Implement continuous improvement areas
  • Create and maintain procedural documentation

• 10 years in Information Security, IT Risk Management, regulatory compliance or audit functions, within a US or Canadian bank (preferably at least 5 years in a leadership role)
• Deep knowledge of key information security domains including network security, IAM, data protection, vulnerability management, application security,…