Sr. Manager, Information Security - Regulatory & Examination

We’re building a relationship-oriented bank for the modern world. We need talented, passionate professionals who are dedicated to doing what’s right for our clients.

At CIBC, we embrace your strengths and your ambitions, so you are empowered  team members have what they need to make a meaningful impact and are truly valued for who they are and what they contribute.

To learn more about CIBC, please visit

• Regulatory Exams
  • End to end exam management
  • Ensure regulatory exam readiness
  • Review and suggest approach (responses, evidence) to regulatory exam letters
  • Coordinate response and evidence collection (which may include direct response/fulfillment), evaluating and questioning, aligning on strategic messaging, presenting to sr. leadership to align on audit ready responses
• Regulatory Remediation
  • Actively engage in regulatory remediation activities, which may include analysis of regulatory feedback, suggesting recommended action, coordinating and evaluating responses, performing remediation actions, preparing regulatory update decks, creating speaking notes, ensuring messaging alignment with internal stakeholders and addressing any post meeting follow ups.
• Regulatory Briefings
  • Prepare oversight briefing materials, which includes recommendations on approach/key themes, with speaking notes
  • Coordinate follow up activities
• Internal Audit
  • Ensure internal teams are prepared for Internal Audit activities
  • Manage and socialize Internal Audit calendar
  • Coordinate audits, including fulfillment and evaluation of responses and evidence provided
  • Escalate potential issues before formal identification
  • Ensure timely review and response to audit reports
  • Oversee creation of new audit related deficiencies
  • Serve as point for monthly continuous monitoring
• Program Management - Regulatory Program Compliance
  • Ensure NY DFS program annual activities are completed, including the NY Branch assessment, surveys, with risks identified and actioned
  • Ensure FFIEC/GLBA program activities are completed, including the annual assessment with risks identified and actioned
  • Complete annual Regulatory Control Management activities
  • Complete annual Regulatory Control Requirement Assessment
• Reporting
  • Ensure overall CSO organization regulatory reporting dashboard is delivered
  • Monitor relevant laws, regulations and standards to ensure organization’s security practices align with regulatory requirements. Create and distribute monthly regulatory development update reporting.
  • Assist with creation of materials for Annual Cyber Security Board Review and Quarterly Board Risk Committee Meetings
  • Creation of materials for various reporting committees and forums, including weekly status
  • Creation of materials for various reporting committees and forums, including weekly reports, business unit reviews and horizontal reviews
• Projects
  • Oversee or complete specific enterprise, US region or department initiatives
• General
  • Build strong relationships with internal and external partners, seen by them as a trusted partner
  • Complete ad hoc and urgent requests from internal and external partners, and recommend new controls to reduce risks
  • Work closely with US TI&I Risk & Controls Team, Regulatory Affairs, Operational Risk Management (ORM) and Internal Audit as required.
  • Teamwork and Relationship Building– Foster collaborative relationships with a wide range of stakeholders to identify opportunities to enhance Information Security processes and controls, understand pain-points and priorities, influence direction, solve problems, and ensure successful adoption and operation of policies and standards.
  • Will be required to foster relationships with middle to senior management, and senior executives across a range of functions including Risk Management and Technology.
  • Share governance best practices, based on regulatory and audit observations and feedback identified
  • Provides ongoing advice and direction on a variety of complex conceptual or interpretative issues
  • Perform regulatory controls as assigned control performer
  • Implement continuous improvement areas
  • Create and maintain procedural documentation
  • KNOWLEDGE AND SKILLS
  • 10 years in Information Security, IT Risk Management, regulatory compliance…