IT Risk & Control Director – Cybersecurity

Huntington National Bank

. Serve as a senior Technology Risk partner to Cybersecurity and Technology leadership .

Posted 10/22/2026full-timeUnited StatesLead💰 $125,000 - $255,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive expertise in Technology Risk Management, Cybersecurity Risk, and Information Security Risk, with a strong focus on Identity and Access Management, Cloud Security, and Data Protection. Proven ability to translate complex cybersecurity conditions into business risks and executive insights while leading high-performing teams in a regulated environment.

Highest-signal resume keywords

Technology Risk ManagementCybersecurity Risk AssessmentIdentity And Access ManagementCloud Security ExpertiseData Protection Knowledge

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Identity And Access ManagementPrivileged Access ManagementData ProtectionCloud SecurityVulnerability ManagementCybersecurity ControlsRisk AssessmentsRegulatory ComplianceIncident Risk ManagementRisk Metrics

Soft Skills

Strong Executive PresenceEffective CommunicationCollaborative Relationship BuildingConstructive ChallengeLeadership Development

Tools & Technologies

Microsoft AzureAmazon Web ServicesGoogle Cloud PlatformNIST Cybersecurity FrameworkISO/IEC 27001

Certifications & Qualifications

CISSPCISMCRISCCISACCSP

Industry Keywords

CybersecurityFinancial InstitutionRegulated OrganizationThree Lines ModelRisk And Control Functions

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityGoogle Cloud Platform

About the role

Key responsibilities & impact

Serve as a senior Technology Risk partner to Cybersecurity and Technology leadership
Build collaborative relationships with Cybersecurity, Technology, Data, business-aligned technology teams, Independent Risk, Compliance, Legal, Privacy, Audit, and enterprise stakeholders
Provide risk insight across IAM, PAM, authentication and authorization, identity governance, Data Protection, Cloud Security, Vulnerability and Exposure Management, Application Security, Security Architecture, Cyber Operations, endpoint and network security, and cyber incident risk
Partner with control owners to assess risks involving identity lifecycle management, privileged access, unauthorized access, non-human identities, entitlements, authentication, access certification, and segregation of duties
Advise on cloud adoption and cloud-native technology risks, including identity, privileged access, sensitive data, configuration, workload protection, encryption, secrets management, and monitoring
Provide independent risk perspectives on data security and protection practices, including encryption, key management, DLP, sensitive-data access, and information lifecycle controls
Interpret vulnerability and exposure information and translate technical conditions into business impact, risk concentration, prioritization, and executive insight
Provide risk input into standards, procedures, metrics, KRIs, assessments, risk acceptances, exceptions, issues, and remediation strategies
Analyze cybersecurity risk to identify systemic themes, risk concentrations, control dependencies, and emerging risks
Support root-cause analysis, risk articulation, remediation strategies, risk acceptance, and closure considerations
Prepare executive-level risk assessments, management and Board reporting, regulatory responses, issue updates, and decision materials
Participate in Cybersecurity and Technology governance forums
Monitor developments in cyber threats, architecture, regulation, industry practices, cloud technologies, identity, data protection, and emerging technologies
Lead and develop a high-performing Technology Risk team
Maintain three-lines-model role boundaries and perform other duties as assigned

Requirements

What you’ll need

Bachelor's degree or equivalent level of work experience
10+ years in a related role
Significant experience in first-line technology risk, cybersecurity risk, information security risk, or comparable risk and control functions in a financial institution or highly regulated organization
Knowledge across IAM/PAM, Data Protection, Cloud Security, Vulnerability Management, cybersecurity controls, and related security domains
Experience operating within the three lines model and partnering with control owners, Independent Risk, Compliance, Internal Audit, and regulatory stakeholders
Experience advising senior leaders on cybersecurity and technology risks without assuming operational process or control ownership
Ability to translate complex cybersecurity conditions into business risk, control implications, residual risk considerations, risk trends, and executive insights
Experience leading senior professionals and developing risk talent within complex, matrixed organizations
Deep understanding of Identity and Access Management and Privileged Access Management
Strong understanding of Data Protection, including encryption, key management, DLP, sensitive-information access, and information lifecycle
Strong understanding of Cloud Security, including identity and access, workload protection, infrastructure security, configuration, encryption, secrets management, and cloud governance
Strong understanding of Vulnerability and Exposure Management, Application Security, Security Architecture, endpoint and network security, Cybersecurity Operations, and incident-related risk
Working knowledge of NIST Cybersecurity Framework, NIST SP 800-53, NIST Zero Trust guidance, CIS Controls, and ISO/IEC 27001
Experience assessing risk in Microsoft Azure, Amazon Web Services (AWS), or Google Cloud Platform (GCP)
Experience with risk assessments, RCSAs/control assessments, issue management, risk acceptance, remediation governance, control testing results, KRIs, audit engagement, and regulatory examinations
Ability to identify systemic and aggregate risk themes across cybersecurity findings, metrics, control deficiencies, risk acceptances, exceptions, and other risk indicators
Strong executive presence and ability to communicate cybersecurity risk to senior management, Board-level audiences, regulators, Independent Risk, and Internal Audit
Ability to provide constructive and credible challenge while maintaining collaborative relationships and clear ownership boundaries
Strong written and verbal communication skills
Relevant certifications such as CISSP, CISM, CRISC, CISA, or CCSP preferred

Benefits

Comp & perks

Applicable incentive compensation plan
Health insurance coverage
Wellness program
Life and disability insurance
Retirement savings plan
Paid leave programs
Paid holidays
Paid time off (PTO)
Flexible work arrangement may be available for certain positions outside the branch network