Lead – Cybersecurity GRC & Risk Management

About Northern Trust

As a global leader in innovative wealth management, asset servicing, asset management and banking services, Northern Trust (Nasdaq: NTRS) is proud to guide the world’s most successful individuals, families, corporations and institutions.

Since 1889, we have aligned our efforts with our three guiding Principles That Endure: Service, Expertise, and Integrity. Together, they reflect the three cornerstones of business conduct which we strive to instill in our employees, whom we call partners, and to provide to our clients and the communities we serve worldwide.

With more than 135 years of financial experience and over 24,000 partners, we serve the world’s most sophisticated clients using leading technology and exceptional service.

Summary

Northern Trust Technology Cybersecurity GRC function is responsible for enabling Global Cybersecurity to strong 1st Line of Defense, foster a control aware culture, deliver compliant and secure technology capabilities, protect customers and meet regulatory requirements. The Lead role is part of the Cybersecurity GRC Team, responsible for leading and supporting risk and control assessments for core cyber security domains, performing security testing, and evaluating compliance to information security policies and procedures and regulatory requirements. The role will work directly with cybersecurity, Infrastructure and business units’ teams providing guidance to implement defense-in-depth controls to protect Northern Trust and the customers. As well as working with a dynamic team and contributing to the overall cyber security of the firm. 

Major Duties include but not limited to;

• Advise and support risk and control assessments for core cyber security domains
• Lead remediation of cyber security findings from various sources
• Solves problems and timely management of open risk and control gaps
• Support the development and maintenance of cyber security standards in line with industry best practices, as well as support technical engagements around security threats & vulnerabilities and software security testing

Knowledge /Skills/Abilities/Experience & Desirable Criteria include;

• Strong knowledge across core cybersecurity domains, including IAM, Data Protection, Vulnerability Management, Threat Management, Incident Response, Application Security, Network Security, Cloud Security and Cyber GRC.
• Good understanding of regulatory requirements and frameworks, including CHIPS, CHAPS and FRB-related requirements.
• Strong knowledge of cybersecurity and risk management frameworks, including NIST CSF, NIST RMF, CRI Profile and APQC.
• Thorough understanding of Issue Management and remediation processes, including identification, assessment, tracking, validation, and closure of control gaps.
• Experience in mapping cybersecurity controls to risks, Issues/IPTs, regulatory requirements, industry frameworks, and internal policies/procedures.
• Strong knowledge of cybersecurity control testing and audit methodologies, including control design and operating effectiveness assessments, risk identification, and gap analysis.
• Experience working across the 2nd and/or 3rd Lines of Defense, particularly in control testing, independent validation, and audit activities.
• Knowledge and experience in conducting cybersecurity maturity assessments and identifying improvement opportunities.
• Good understanding of Cloud Security risks, controls, and governance requirements.
• Strong evidence analysis and validation skills, including the ability to assess evidence against control descriptions, Issues/IPTs, policies, procedures, and regulatory requirements.
• Technical or audit experience in core cyber security fields such as vulnerability / threat management, Pen-Testing, IAM, Data Protection, IH / IR, AppSec, Network Security, System Administrator, GRC
• Understanding of Controls across Cybersecurity domains
• Knowledge of performing risk management and industry standards, NIST etc.
• Ability to proactively assess issues, identify solutions and problem solve.
• Ability to understand and interact with technology subject matter experts regarding technology topics
• Analytical, consultative and communication skills with ability to communicate control requirements to partners in terms easily understood
• Organized and time management skills, with ability to produce high-quality timely deliverables
• Flexible approach towards changing work methods, deadlines and variable workloads.
• Ability to adapt and react timely and positively in a changing and dynamic work environment.
• Expertise in Microsoft Office Suite and ability to learn new tools as needed.
• Applicable industry standard certification(s) desired
• Bachelor’s degree in computer science or a related discipline and technical experience in the security aspects of multiple platforms, operating systems, software, communications and network protocols or an equivalent combination of education and work experience

Major Duties:

• Provides consultative support, best practice guidance and support to internal/external teams to Cybersecurity , Technology and Business Units staff in risk assessments, implement.
• Identifies, evaluates, conducts, schedules and leads technical analyses functions to ensure all applicable Cybersecurity requirements are met.
• Participates in the evaluation, development, implementation, communication, monitoring and maintenance of Cybersecurity policies and procedures.
• May act as Project Leader with servant leadership approach
• May be involved in helping and training to other specialists and team members on .
• Keeping abreast on the direction of emerging industry standards.
• Provides technical analysis of requirements necessary for the protection of all information processed, stored, or transmitted by systems.
• Serves as an expert resource or ¿go to person¿ within a group.
• Conduct preliminary analysis.
• Review work of others.
• Handles more extensive, high-profile work.
• Responsible for direct interaction with different committees and/or management.
  
  Knowledge:

Is a technical expert with in-depth knowledge in area of expertise and strong knowledge of other areas. Requires excellent analytical ability, consultation and communication skills, strong judgment and the ability to work effectively with clients, IT management and staff, vendors and consultants.

Experience:

Bachelor’s degree in computer science or a related discipline and at least four, typically six or more years of technical experience in the security aspects of multiple platforms, operating systems, software, communications and network protocols or an equivalent combination of education and work experience.

Key Responsibilities

• Lead and support risk and control assessments across cybersecurity domains, including Identity and Access Management, Data Protection, Vulnerability Management, Threat Management, Incident Response, Application Security, Network Security, Cloud Security, and Cyber GRC.
• Plan, conduct, and oversee cybersecurity control evidence collection, risk identification, evidence validation, and control gap analysis.
• Lead the identification, assessment, tracking, validation, and closure of cybersecurity issues and control gaps, ensuring timely and sustainable remediation.
• Review cybersecurity findings from control testing, risk assessments, audits, regulatory reviews, and other assurance activities, and work with control owners to develop appropriate remediation strategies.
• Map cybersecurity controls to applicable risks, Issues/IPTs, regulatory requirements, industry frameworks, and internal policies and procedures.
• Evaluate evidence against control descriptions, documented procedures, Issues/IPTs, risk statements, and regulatory requirements to determine whether controls are appropriately designed and operating effectively.
• Provide technical and risk-management guidance to Cybersecurity, Technology, Infrastructure, Business, and IT Management teams regarding control implementation and defense-in-depth security practices.
• Participate in the development, implementation, communication, monitoring, and maintenance of cybersecurity policies, standards, procedures, and control requirements.
• Support technical engagements involving security threats and vulnerabilities, penetration testing, software security testing, Cloud Security, and other emerging cybersecurity risks.  
• Conduct cybersecurity maturity assessments, identify capability gaps, and recommend practical improvement opportunities aligned with organizational risk appetite and industry practices.
• Serve as a cybersecurity risk and control subject matter expert and act as the primary point of contact for complex or high-profile risk and control matters.
• Lead technical analyses and risk-based reviews to ensure applicable information security and regulatory requirements are appropriately addressed.
• Review the quality and completeness of work performed by team members and provide guidance, training, and technical assistance to junior specialists.  
• Lead or support cybersecurity risk and control projects, coordinate activities across multiple stakeholders, and ensure timely delivery of high-quality outcomes.
• Prepare and present clear risk assessments, control testing results, remediation updates, and management-level reporting to senior stakeholders and governance committees.
• Maintain awareness of emerging cybersecurity threats, regulatory expectations, technologies, and industry standards, and assess their potential impact on the organization’s control environment.

Required Knowledge and Skills

• Strong knowledge of cybersecurity domains, including IAM, Data Protection, Vulnerability Management, Threat Management, Incident Response, Application Security, Network Security, Cloud Security, and Cyber GRC.
• Strong understanding of technology risk management, cybersecurity controls, control testing, audit methodologies, and design and operating effectiveness assessments.
• Working knowledge of cybersecurity and risk management frameworks, including NIST Cybersecurity Framework, NIST Risk Management Framework, CRI Profile, and APQC
• Understanding relevant regulatory requirements, including CHIPS, CHAPS, and FRB-related requirements.
• Experience with issue management and remediation processes, including issue identification, risk assessment, action-plan development, tracking, validation, and closure.  
• Experience working within the First, Second, or Third Line of Defense, particularly in cybersecurity control testing, independent validation, risk management, or audit activities.
• Strong analytical and problem-solving skills, with the ability to evaluate complex technology risks and recommend practical solutions.
• Excellent consultative, stakeholder-management, and communication skills, with the ability to explain cybersecurity risks and control requirements in clear business language.
• Ability to interact effectively with technical subject matter experts, IT management, business stakeholders, vendors, consultants, senior management, and governance committees.
• Strong organizational and time-management skills, with the ability to manage changing priorities, variable workloads, and multiple deadlines while maintaining high-quality deliverables.
• Strong judgment and the ability to independently manage complex, sensitive, and high-profile cybersecurity risk matters.
• Proficiency in Microsoft Office applications and the ability to quickly learn and effectively use new risk-management and cybersecurity tools.

Education and Experience

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related discipline, or an equivalent combination of education and relevant professional experience.
• Typically six or more years of relevant experience in cybersecurity, technology risk management, information security, control testing, audit, or related areas.  
• Technical or audit experience across multiple platforms, operating systems, applications, communication technologies, and network protocols is preferred.
• Relevant industry certifications such as CISA, CRISC, CISSP, CCSP, or equivalent cybersecurity, risk-management, or audit certifications are desirable. The source document requires applicable industry certifications but does not prescribe specific certifications.

Leadership Expectations

The role is expected to operate as a technical expert, reviewer, project lead, and trusted advisor. The individual should be capable of independently handling complex assignments, guiding junior team members, reviewing the work of others, engaging with management and governance committees, and influencing stakeholders to improve the organization’s cybersecurity risk and control environment.

Working with Us

As a Northern Trust partner, you will be part of a flexible and collaborative work culture, which has a strong history of financial strength and stability. Movement within the organization is encouraged, senior leaders are accessible, and you can take pride in working for a company committed to an inclusive workplace and assisting the communities we serve.

Philanthropy is deeply rooted in Northern Trust’s history and is an essential element of our culture. Employees around the world give their time and talent to work for the greater good of their communities.

Reasonable Accommodation

Northern Trust is committed to working with and providing adjustments to individuals with health conditions and disabilities. If you need a reasonable accommodation for any part of the employment process, please email our HR Service Center at [email protected], or alternatively you can discuss your individual requirements with the recruiter you are working with.

About Our Pune Office

The Northern Trust Pune office, established in 2016, is now home to over 3,000 employees. The office handles various functions, including Operations for Asset Servicing and Wealth Management, as well as delivering critical technology solutions that support business operations across the globe.

Our Pune team takes our commitment to service to heart. In 2024, they volunteered more than 10,000+ hours into the communities where they live and work. Learn more.