Managing Director Cyber and Technology Risk

Address:

Overview

BMO is seeking a strategic and forward-thinking Managing Director, Cyber & Technology Risk to lead a growing portfolio focused on the independent oversight, assessment, and evolution of the Bank's cyber and technology risk posture. This senior leadership role operates within the 2nd of Defense (2LOD) and is responsible for providing effective challenge, independent review, and risk oversight across cybersecurity, technology controls, and emerging technology risks, including Artificial Intelligence.

The successful candidate will bring deep expertise in cybersecurity risk management and transformational leadership within a large, complex, highly regulated enterprise. This individual will build and mature a growing portfolio, lead a team of six professionals across North America, and serve as a trusted advisor to senior executives, business leaders, and risk stakeholders.

The role is heavily focused on cybersecurity risk (approximately 80%) with responsibility for broader technology risk management (approximately 20%).

Role Purpose

• Identifies, assesses, remediates and reports of Cybersecurity and Technology risk and ensures these risks are managed within the Risk appetite of the Bank.

• Plays a critical role in ensuring the company's risk-taking entities are aware of the risks inherent in their activities and decisions, the impact of their actions on the company at an enterprise level, and opportunities to reduce, mitigate, or avoid risks altogether. As an ONFR leader, works closely with colleagues across ERPM and with other businesses and functions across the enterprise.

• Delivers expert advice, credible challenge, and effective oversight across to identify, assess, control, and manage these risks throughout the company. Provides strategic future forward vision of the required maturity of these risk domains leveraging more predictive analytics.

Key Accountabilities:

• Provides subject matter expertise, specialist support, and oversight for Risk Speciality Areas relating to cyber and technology risk.

• Establishing risk standards required to mitigate Cyber and Technology Risk, to comply with regulatory requirements, Corporate Policies, Corporate Standards

• Own the enterprise-wide second line technology and cyber risk oversight strategy, ensuring independent challenge across all technology and cyber risk domains.

• Provide oversight over control improvements and actions that underway (issue etc.) to manage Cyber and Technology Risk exposures, providing Effective Challenge and oversight as appropriate.

• Through independent assessments, reviews and recommends changes to processes or procedures, and oversees any significant business unit corrective actions, as necessary

• Provide independent oversight and challenge over first-line risk assessments, control testing, control self-assessments, risk acceptances, issue management activities, remediation plans, and material technology and cyber initiatives.

• Lead governance and reporting activities for Technology and Cyber Risk, including Cyber Risk sub-committees and providing independent risk updates to executive management committees, including T&O risk committees, enterprise risk committees

• Report an independent Technology and Cyber Risk Profile, including material exposures, emerging risks, control effectiveness, thematic concerns, and risks outside of tolerance, to senior management, regulators, and Board committees.

• Oversee the identification, assessment, management, and reporting of emerging technology and cyber risks, ensuring evolving threats, industry trends, disruptive technologies, and regulatory expectations are reflected in the Bank's risk management practices.

• Provide independent oversight of Business Managed Applications (BMA), end-user computing environments, and other business-owned technology assets to ensure appropriate governance, control, and risk management practices are established and maintained.

• Plays a key role in assessing and enhancing the organization's cyber and technology risk capability maturity and maintains and updates risk models, identifying and developing innovative risk assessment techniques, incorporating data driven and continuous risk assessments.

• Develop and implement mechanisms to identify emerging trends and best practices in technology cyber risk management, leveraging resources / industry trends

• Update and maintain key performance indicators (KPIs) and key risk indicators (KRIs) to objectively measure program effectiveness / identify areas for improvement.

• Leads the development and implementation of key risk indicators (KRIs), key performance indicators (KPIs) that are risk sensitive and adapting as new threats emerge.

• Drive independent assessments of the bank’s information security, cybersecurity, cloud and technology capabilities, and provide expertise and advice on accelerating maturity of the firm's cyber capabilities

• Provides independent expertise during capability maturity reviews, preparing independent assessments of maturity levels, and developing reports for senior management. Identifies and assesses alternative approaches to risk mitigation and advises the business and stakeholder leadership with respect to trade-offs.

• Provide updates to regulators on cyber and technology risk with respect to existing controls, the risk management framework overall, and emerging threats and challenges, including the OCC, FRB, and OSFI

• Stays current on emerging NFR sub-risk threats and potential implications to the firm and mentors/coaches more junior members of the team.

• Collaborates effectively with colleagues, stakeholders, and leaders across multiple organizations to achieve objectives

• Leads program-related activities and deliverables to ensure effective collaboration within the team and across stakeholder groups

• Within the mandate of this role, promotes and supports the Bank's risk culture including ensuring employees understand their accountabilities for risk-taking activities, promoting an environment of open communication and effective challenge, and establishing the "tone from the top" through leading by example.

• Complies with the Bank's Risk Appetite framework and ensures risk-taking activities remain within agreed limits and comply with all regulatory requirements.

• Drive simplicity and productivity enhancements for optimization across groups driving continuous improvement on key measures.

• Activates our winning culture, aligned with Purpose. Ignites engagement by aligning our culture to our strategy and fueling exceptional execution.

• Fosters diversity, equity and inclusion and creates an inclusive environment for all employees by eliminating barriers to inclusion.

• Develops leaders, plans for succession, and fosters a high-performance culture.

• Drives top talent acquisition and retention, developing organizational capabilities to drive competitive advantage.

• Leads and mentors a team with diverse risk experience, skills and orientation.

Qualifications:

• An undergraduate degree is required; Professional certifications (CISSP, CCSP, AWS CCP, etc.) beneficial

• 15+ years of cyber security experience with at least five years of managing a team and influencing management and key stakeholders.

• Candidates must have had exposure to technology in a large, complex, regulated financial services enterprise.

• Must be highly skilled NFR sub-risk professional who has a wealth of experience and a demonstrated ability to provide value added recommendations and deliver high-impact results.

• Proven ability to manage a team and work independently in a fast-paced environment and can begin contributing immediately

• Leverage strong investigative, problem-solving, and decision-making skills to resolve complex risk and compliance issues, driving informed decisions and effective mitigation strategies,

• Strong technical acumen in 2 or more areas: cybersecurity, technology, data protection, Identity Access Management, Infrastructure security

Base salary $170, 000 to $200, 000

The above represents BMO Financial Group’s pay range and type.

Salaries will vary based on factors such as location, skills, experience, education, and qualifications for the role, and may include a commission structure. Salaries for part-time roles will be pro-rated based on number of hours regularly worked. For commission roles, the salary listed above represents BMO Financial Group’s expected target for the first year in this position.

BMO Financial Group’s total compensation package will vary based on the pay type of the position and may include performance-based incentives, discretionary bonuses, as well as other perks and rewards. BMO also offers health insurance, tuition reimbursement, accident and life insurance, and retirement savings plans. To view more details of our benefits, please visit: https://jobs.bmo.com/global/en/Total-Rewards

About Us

At BMO we are driven by a shared Purpose: Boldly Grow the Good in business and life. It calls on us to create lasting, positive change for our customers, our communities and our people. By working together, innovating and pushing boundaries, we transform lives and businesses, and power economic growth around the world.

As a member of the BMO team you are valued, respected and heard, and you have more ways to grow and make an impact. We strive to help you make an impact from day one – for yourself and our customers. We’ll support you with the tools and resources you need to reach new milestones, as you help our customers reach theirs. From in-depth training and coaching, to manager support and network-building opportunities, we’ll help you gain valuable experience, and broaden your skillset.

To find out more visit us at https://jobs.bmo.com/ca/en.

BMO is committed to an inclusive, equitable and accessible workplace. By learning from each other’s differences, we gain strength through our people and our perspectives. Accommodations are available on request for candidates taking part in all aspects of the selection process. To request accommodation, please contact your recruiter.

Note to Recruiters: BMO does not accept unsolicited resumes from any source other than directly from a candidate. Any unsolicited resumes sent to BMO, directly or indirectly, will be considered BMO property. BMO will not pay a fee for any placement resulting from the receipt of an unsolicited resume. A recruiting agency must first have a valid, written and fully executed agency agreement contract for service to submit resumes.