Cyber Resilience Associate

SMBC; Charlotte (NC); Ibrido; USD 90.000 - 120.000; Tempo pieno

Vantaggi offerti da questo lavoro

Hybrid work model

Disability accommodations

Descrizione del lavoro

SMBC’s Americas Division Information Security Office seeks an Emerging Tech, Risk and Threat Analyst Associate to support threat modeling, emerging technology risk analysis, and control mapping across AI, cloud services, APIs, and data integrations.

The role requires documenting assets, attack paths, and residual risks, and translating technical findings for senior stakeholders. Hybrid work is available and candidates should reside within commuting distance.

Competenze

• 2+ years of experience in cybersecurity, technology risk, information security, operational resilience, audit, application security, architecture, threat intelligence, or a related technology control function.
• Foundational understanding of cybersecurity risk concepts, including threats, vulnerabilities, controls, attack surfaces, compensating controls, and residual risk.
• Working knowledge of threat modeling concepts, secure design principles, SDLC practices, cloud services, APIs, identity and access management, and enterprise technology environments.
• Familiarity with emerging technology risk areas, including AI/LLM systems, automation, data protection, third-party technology platforms, and cloud-based services.
• Ability to analyze technical information, identify risk-relevant patterns, and document findings in a clear, structured, and evidence-based manner.
• Strong written communication skills, including the ability to summarize technical risks for non-technical stakeholders.
• Strong organizational skills with the ability to manage multiple assignments, track open items, and maintain accurate documentation.
• Ability to work effectively in a matrixed environment with technology, cybersecurity, risk, compliance, business, and vendor stakeholders.
• Familiarity with industry frameworks and references such as NIST CSF, NIST SP 800-53, ISO 27001/27002, OWASP Top 10, OWASP LLM Top 10, MITRE ATT&CK, MITRE ATLAS, or similar control/threat frameworks.
• Experience with risk assessment tools, GRC platforms, vulnerability management tools, architecture repositories, diagramming tools, or threat modeling platforms preferred.
• Basic scripting, data analysis, reporting, or workflow automation experience preferred but not required.
• Financial services, regulated industry, consulting, or enterprise technology experience preferred.
• BA/BS in Cybersecurity, Computer Science, Information Systems, Information Technology, Engineering, Business, Risk Management, or equivalent relevant experience.
• Relevant certifications preferred but not required, such as Security+, CySA+, GSEC, GCIH, SSCP, CISA, CRISC, CCSK, cloud fundamentals certifications, or AI/security-focused training.

Mansioni

• Support threat modeling and emerging technology risk assessments across applications, platforms, business services, and third-party technology solutions.
• Analyze emerging technology use cases, including AI/LLM-enabled capabilities, automation, cloud services, APIs, data integrations, and security tooling, to identify relevant threat scenarios and risk themes.
• Assist in documenting assets, data flows, trust boundaries, dependencies, threat agents, attack paths, control coverage, and residual risks.
• Support risk analysis for AI and LLM-related scenarios, including prompt injection, data leakage, model misuse, excessive agency, insecure integrations, insecure outputs, and third-party dependency risks.
• Help maintain threat modeling evidence, assessment workpapers, issue documentation, and reporting artifacts in approved program repositories and tools.
• Partner with application, architecture, infrastructure, information security, technology risk, and business stakeholders to collect assessment information and validate findings.
• Support mapping of identified risks and controls to relevant frameworks, standards, and internal control taxonomies, such as NIST, ISO, OWASP, MITRE, and internal cyber resilience/control frameworks.
• Assist in preparing concise reports, summaries, dashboards, and briefing materials that communicate assessment scope, key risks, control observations, open questions, and recommended next actions.
• Track action items, enhancement opportunities, and issue remediation activities identified through threat modeling or emerging technology risk reviews.
• Monitor emerging cybersecurity and technology risk trends, including AI security, adversarial use of automation, cloud security, API abuse, supply chain risk, and sector-relevant threat activity.
• Support process improvement by helping refine templates, playbooks, taxonomies, questionnaires, and repeatable assessment procedures.
• Contribute to cross-functional discussions related to secure adoption of emerging technologies, operational resilience, and risk-informed technology decision-making.
• Maintain awareness of the firm’s important business services, critical systems, technology dependencies, and third-party relationships to support resilience-focused analysis.
• Perform multiple concurrent assignments while maintaining accuracy, traceability, and clear documentation.

Conoscenze

Cybersecurity

Technology risk

Threat modeling

Communication skills

Documentation

Stakeholder management

Formazione

BA/BS in Cybersecurity

Strumenti

GRC platforms

Threat modeling platforms

Diagramming tools

Vulnerability management tools

Descrizione del lavoro

Select how often (in days) to receive an alert:

SMBC Group is a top-tier global financial group. Headquartered in Tokyo and with a 400-year history, SMBC Group offers a diverse range of financial services, including banking, leasing, securities, credit cards, and consumer finance. The Group has more than 130 offices and 80,000 employees worldwide in nearly 40 countries. Sumitomo Mitsui Financial Group, Inc. (SMFG) is the holding company of SMBC Group, which is one of the three largest banking groups in Japan. SMFG’s shares trade on the Tokyo, Nagoya, and New York (NYSE: SMFG) stock exchanges.

In the Americas, SMBC Group has a presence in the US, Canada, Mexico, Brazil, Chile, Colombia, and Peru. Backed by the capital strength of SMBC Group and the value of its relationships in Asia, the Group offers a range of commercial and investment banking services to its corporate, institutional, and municipal clients. It connects a diverse client base to local markets and the organization’s extensive global network. The Group’s operating companies in the Americas include Sumitomo Mitsui Banking Corp. (SMBC), SMBC Nikko Securities America, Inc., SMBC Capital Markets, Inc., JRI America, Inc., SMBC Leasing and Finance, Inc., Banco Sumitomo Mitsui Brasileiro S.A., and Sumitomo Mitsui Finance and Leasing Co., Ltd.

Role Description

Reporting to the VP, Cyber Resilience, this Associate role resides within the Cyber Resilience team in the SMBC Americas Division Information Security Office. The role supports the identification, assessment, and communication of cyber, technology, and operational resilience risks associated with emerging technologies, including artificial intelligence, automation, cloud services, third-party platforms, and evolving threat modeling capabilities.

The Emerging Tech, Risk and Threat Analyst Associate will support day-to-day activities across threat modeling, emerging technology risk analysis, control mapping, issue documentation, and stakeholder reporting. The role will help evaluate how new technologies introduce or change threat scenarios, dependencies, attack surfaces, misuse cases, and resilience considerations across important business services, applications, infrastructure, vendors, and technology processes.

The ideal candidate is analytical, detail-oriented, and comfortable working across cybersecurity, technology risk, architecture, and business stakeholders. The candidate should be able to learn new technical domains quickly, document risk-relevant observations clearly, and translate technical concepts into practical risk language for both technical and non-technical audiences.

Role Objectives

• Support the execution of threat modeling and emerging technology risk assessments across applications, platforms, business services, and third-party technology solutions.
• Analyze emerging technology use cases, including AI/LLM-enabled capabilities, automation, cloud services, APIs, data integrations, and security tooling, to identify relevant threat scenarios and risk themes.
• Assist in documenting assets, data flows, trust boundaries, dependencies, threat agents, attack paths, control coverage, and residual risks.
• Support risk analysis for AI and LLM-related scenarios, including prompt injection, data leakage, model misuse, excessive agency, insecure integrations, insecure outputs, and third-party dependency risks.
• Help maintain threat modeling evidence, assessment workpapers, issue documentation, and reporting artifacts in approved program repositories and tools.
• Partner with application, architecture, infrastructure, information security, technology risk, and business stakeholders to collect assessment information and validate findings.
• Support mapping of identified risks and controls to relevant frameworks, standards, and internal control taxonomies, such as NIST, ISO, OWASP, MITRE, and internal cyber resilience/control frameworks.
• Assist in preparing concise reports, summaries, dashboards, and briefing materials that communicate assessment scope, key risks, control observations, open questions, and recommended next actions.
• Track action items, enhancement opportunities, and issue remediation activities identified through threat modeling or emerging technology risk reviews.
• Monitor emerging cybersecurity and technology risk trends, including AI security, adversarial use of automation, cloud security, API abuse, supply chain risk, and sector-relevant threat activity.
• Support process improvement by helping refine templates, playbooks, taxonomies, questionnaires, and repeatable assessment procedures.
• Contribute to cross-functional discussions related to secure adoption of emerging technologies, operational resilience, and risk-informed technology decision-making.
• Maintain awareness of the firm’s important business services, critical systems, technology dependencies, and third-party relationships to support resilience-focused analysis.
• Perform multiple concurrent assignments while maintaining accuracy, traceability, and clear documentation.

Qualifications and Skills

• 2+ years of experience in cybersecurity, technology risk, information security, operational resilience, audit, application security, architecture, threat intelligence, or a related technology control function.
• Foundational understanding of cybersecurity risk concepts, including threats, vulnerabilities, controls, attack surfaces, compensating controls, and residual risk.
• Working knowledge of threat modeling concepts, secure design principles, SDLC practices, cloud services, APIs, identity and access management, and enterprise technology environments.
• Familiarity with emerging technology risk areas, including AI/LLM systems, automation, data protection, third-party technology platforms, and cloud-based services.
• Ability to analyze technical information, identify risk-relevant patterns, and document findings in a clear, structured, and evidence-based manner.
• Strong written communication skills, including the ability to summarize technical risks for non-technical stakeholders.
• Strong organizational skills with the ability to manage multiple assignments, track open items, and maintain accurate documentation.
• Ability to work effectively in a matrixed environment with technology, cybersecurity, risk, compliance, business, and vendor stakeholders.
• Familiarity with industry frameworks and references such as NIST CSF, NIST SP 800-53, ISO 27001/27002, OWASP Top 10, OWASP LLM Top 10, MITRE ATT&CK, MITRE ATLAS, or similar control/threat frameworks.
• Experience with risk assessment tools, GRC platforms, vulnerability management tools, architecture repositories, diagramming tools, or threat modeling platforms preferred.
• Basic scripting, data analysis, reporting, or workflow automation experience preferred but not required.
• Financial services, regulated industry, consulting, or enterprise technology experience preferred.
• BA/BS in Cybersecurity, Computer Science, Information Systems, Information Technology, Engineering, Business, Risk Management, or equivalent relevant experience.
• Relevant certifications preferred but not required, such as Security+, CySA+, GSEC, GCIH, SSCP, CISA, CRISC, CCSK, cloud fundamentals certifications, or AI/security-focused training.

SMBC’s employees participate in a Hybrid workforce model that provides employees with an opportunity to work from home, as well as, from an SMBC office. SMBC requires that employees live within a reasonable commuting distance of their office location. Prospective candidates will learn more about their specific hybrid work schedule during their interview process. Hybrid work may not be permitted for certain roles, including, for example, certain FINRA-registered roles for which in-office attendance for the entire workweek is required.

SMBC provides reasonable accommodations during candidacy for applicants with disabilities consistent with applicable federal, state, and local law. If you need a reasonable accommodation during the application process, please let us know at [e-mail].