C

Citi

Runs banking and payments for global clients

Head of Cyber Risk Management

Security Governance, Risk & ComplianceConfirmed live in the last 24 hours
Full-timeMexico City, CDMX, MexicoNo salary listedHybrid

About the Job

Requirements

  • At least 15 years of relevant experience.
  • In-depth database knowledge is preferred in the English qualifications.
  • Demonstrated technical aptitude and an advanced understanding of networking protocols and infrastructure designs.
  • Advanced analytical and problem-solving skills.
  • Clear and concise written and verbal communication.
  • Proficiency in interpreting and applying policies, standards, and procedures.
  • Ability to remain unbiased in a diverse working environment.
  • Bachelor’s degree or university degree, or equivalent experience.
  • Knowledge of governance, risk, and compliance, including cyber risk and technology risk management.
  • Knowledge of identifying, assessing, treating, and monitoring risks.
  • Ability to design and monitor risk metrics (KRIs) and executive dashboards.
  • Knowledge of ISO 27001, ISO 27005, ISO 31000, NIST CSF 2.0, NIST RMF, and COBIT.
  • Familiarity with vulnerability management tools and tools for perimeter security posture, cloud security posture, and third-party cybersecurity posture (TPCRM).
  • Familiarity with governance, risk, and compliance (GRC) tools.
  • Familiarity with security testing and automated security validation tools.
  • Knowledge of data protection and privacy.
  • Knowledge of risks associated with artificial intelligence and generative models.
  • Knowledge of business continuity, operational resilience, and crisis management.
  • Knowledge of risk assessment in digital banking, including payment methods, applications, and APIs, as well as critical infrastructure and technology providers.
  • Experience in highly regulated organizations, preferably banking, financial services, insurance, fintech, or payment services.
  • Experience interacting with regulators, internal and external auditors, risk committees, and senior management.
  • Experience leading third-party risk, vulnerability, compliance, and security governance programs.
  • Experience assessing technology risks, strategic projects, cloud migrations, and adoption of new technologies.
  • Experience managing remediation plans and reducing critical risks.
  • Experience participating in crisis exercises and business continuity and operational resilience activities.
  • Knowledge of cybersecurity risk management, technology risk, security audit, security governance, or related fields.
  • Ability to lead cybersecurity risk management, technology risk, GRC, or security governance functions.
  • Bachelor’s degree or engineering degree in systems, computer science/informatics, cybersecurity, information technology, or a related field.
  • Master’s degree in risk, information security, information technology, business administration, or a related area is desirable.
  • Desirable certifications include CISM, CISA, CRISC, CISSP, CGEIT, ISO 27001 Lead Auditor, or ISO 27005 Risk Manager.

Responsibilities

  • Plan and execute the information security strategy and develop and manage security solutions across multiple areas.
  • Use a global risk management model to analyze emerging security threats and define solutions to mitigate exposure.
  • Advise business and IT leaders and provide direction on risk management decisions.
  • Align the information security program with business strategy and coordinate with leadership to achieve program goals.
  • Determine the approach to executing functional strategy and oversee results, budgeting, planning, policy, and future strategy formulation.
  • Advance discussions on strategic solutions for the program or business.
  • Oversee resource management and work allocation, manage a team, and advise and coach newer or lower-level analysts.
  • Assess risk in business decisions, safeguard the firm, clients, and assets, drive compliance with applicable laws, rules, and regulations, adhere to policy, apply sound ethical judgment, and transparently escalate, manage, and report control issues; supervise others and hold them accountable for meeting standards.
  • Define and maintain the cyber risk management framework.
  • Establish methodologies to identify, assess, treat, and monitor technology and cyber risks.
  • Develop KRIs, executive metrics, and reports for risk committees and senior management.
  • Lead risk assessments of platforms, applications, infrastructure, digital services, cloud environments, and artificial intelligence.
  • Maintain the corporate cyber risk inventory, including existing and emerging vulnerabilities and threats.
  • Ensure traceability of risks, controls, evidence, and action plans.
  • Define and track remediation plans for critical risks.
  • Oversee the effectiveness of preventive, detective, and corrective controls.
  • Oversee the proper management of security baseline configurations.
  • Develop and improve vulnerability management processes, including consideration of technical debt.
  • Coordinate vulnerability management, penetration testing, security assessments, and Red Team exercises.
  • Validate prioritization and remediation of critical vulnerabilities and findings.
  • Lead the third-party cybersecurity risk assessment program (TPCRM), including for outsourced services.
  • Define security requirements for contracts, service agreements, and digital supply chains.
  • Coordinate internal, external, and regulatory audits.
  • Promote adoption of frameworks including ISO 27001, ISO 27005, ISO 31000, NIST CSF, NIST RMF, and COBIT.
  • Translate technical findings into business and financial impacts.
  • Lead and develop multidisciplinary cyber risk, governance, and compliance teams.

Desired Qualifications

  • A master's degree is preferred.
  • In-depth database knowledge is preferred.
  • Additional technical certifications are preferred.
  • More than 10 years of experience in cybersecurity, technology risk, audit, security governance, or related areas is desirable.
  • More than 5 years of experience leading cyber risk management, technology risk, GRC, or security governance functions is desirable.
  • Experience in highly regulated organizations, preferably banking, financial services, insurance, fintech, or payment services.
  • A master's degree in risk, information security, information technology, business administration, or a related area is desirable.
  • Certifications such as CISM, CISA, CRISC, CISSP, CGEIT, ISO 27001 Lead Auditor, or ISO 27005 Risk Manager are desirable.

About the Company

Citi

Runs banking and payments for global clients

Citi runs banking, investment and payment services for companies, governments and individuals around the world. Its global network connects institutions with local banking systems, while its US consumer business sells credit cards and deposit accounts. Corporate clients use Citi to manage cash, finance trade and raise capital, and investors use its trading, custody and wealth services to hold and manage assets. The bank earns interest on loans and fees from payments, securities transactions, financial advice and account services. Citi traces its banking roots to 1812; the Citigroup holding company was formed in 1998, and its headquarters are in New York City.

Company size
10,001+
Company stage
IPO
Headquarters
New York City, New York
Founded
1812

Recently Posted Jobs

Explore more opportunities at Citi

See more jobs