Cyber Security & Third Party Due Diligence Associate Director

The Depository Trust & Clearing Corporation (DTCC); Tampa (FL); Hybrid; USD 140,000 - 180,000; Full time

Benefits offered by this job

Health insurance

Pension / Retirement

Flexible/hybrid model

Job summary

The Depository Trust & Clearing Corporation (DTCC) is seeking a senior cyber risk lead to direct the Cyber Security Due Diligence SME team. You will assess third party technology, resilience, and security controls across DTCC's vendor ecosystem, and guide remediation and onboarding activities with cross-functional teams.

You will collaborate with Business, Legal, Sourcing, and Technology stakeholders to strengthen the Third Party Risk Management program and ensure regulatory alignment and robust

Qualifications

• 8+ years in cyber security, cyber operations, cyber risk, IT audit, or technology risk.
• Bachelor's degree preferred or equivalent experience.
• Certifications such as CISSP, CISA, CRISC or equivalent are a plus.
• Knowledge of CRI, NIST CSF, FFIEC/FFI guidelines is beneficial.

Responsibilities

• Lead the Cyber Security Due Diligence SME team for third party technology and resilience risk assessments.
• Oversee third party onboarding and risk-based decision making in accordance with DTCC policies.
• Escalate complex cyber security and remediation risks identified during assessments.
• Develop reporting on KRIs and program effectiveness for executive stakeholders.

Skills

Cybersecurity

Risk management

Regulatory awareness

stakeholder communication

Education

Bachelor's degree

Certifications such as CISSP/CISA/CRISC

Job description

Are you ready to make an impact at DTCC? Do you want to work on innovative projects, collaborate with a dynamic and supportive team, and receive investment in your professional development? At DTCC, we are at the forefront of innovation in the financial markets. We are committed to helping our employees grow and succeed. We believe that you have the skills and drive to make a real impact. We foster a thriving internal community and are committed to creating a workplace that looks like the world that we serve.

Our Risk Management teams work to protect the safety and soundness of our systems and are responsible for identifying, managing, measuring and mitigating a spectrum of key risk types including credit, market, liquidity, systemic, operational and technology in all existing and new products, activities, processes and systems.

Pay And Benefits

• Competitive compensation, including base pay and annual incentive
• Comprehensive health and life insurance and well-being benefits, based on location
• Pension / Retirement benefits
• Paid Time Off and Personal/Family Care, and other leaves of absence when needed to support your physical, financial, and emotional well-being.
• DTCC offers a flexible/hybrid model of 3 days onsite and 2 days remote (onsite Tuesdays, Wednesdays and a third day unique to each team or employee).

The Impact You Will Have In This Role

In this role, you will lead the Cyber Security Due Diligence SME team within the Cyber Security Risk Office (CSRO), responsible for overseeing technology, cyber security, and operational resilience risk assessments across DTCC's third party ecosystem. Your work will directly contribute to strengthening DTCC's Third Party Risk Management program by ensuring effective identification, assessment, monitoring, and remediation of cyber and technology risks associated with vendors, service providers, and other external partners.

You will work closely with Business, Technology, Legal, Sourcing, Resilience, and Risk Management stakeholders to oversee due diligence assessments, third party onboarding activities, control gap remediation, onsite reviews, and specialized assessments, including fourth party risk, NYSDFS cybersecurity reviews, encryption key management, and software supply chain security. The role is also responsible for advancing third party cyber risk reviews, enhancing assessment methodologies, supporting regulatory compliance, and building a high-performing team of cyber risk professionals.

Your Primary Responsibilities

• Lead and develop a team of Cyber Security Due Diligence SMEs responsible for conducting technology, cyber security, operational resilience, and specialized risk assessments of third parties supporting DTCC's critical services
• Oversee the execution of third party technology and resilience due diligence activities, ensuring assessments are completed in accordance with DTCC policies, regulatory expectations, and established service-level agreements
• Serve as the primary escalation point for complex cyber security, technology, resilience, and remediation-related risks identified during third-party assessments and onboarding activities
• Provide subject matter expertise on third-party cyber risk management, emerging regulatory requirements, and industry best practices, including NYSDFS Cybersecurity Regulation, operational resilience requirements, software supply chain risk, fourth-party risk, and encryption key management
• Direct and oversee technology risk assessments, operational resilience reviews, onsite assessments, and specialized reviews for critical third parties, ensuring identified risks are appropriately assessed, documented, and mitigated
• Partner closely with Sourcing, Legal, Enterprise Program Management, Architecture Review Board (ARB), Technology, Resilience, Security, and Business stakeholders to support third-party onboarding, contract reviews, and risk-based decision making
• Drive remediation management efforts for identified third party control gaps and assessment findings, ensuring appropriate accountability, transparency, and timely risk reduction
• Develop and present meaningful management reporting, key risk indicators (KRIs), and executive-level updates related to third-party cyber risk, emerging trends, remediation status, and program effectiveness
• Build and maintain strong relationships with internal stakeholders, regulators, auditors, and external third parties while representing the Cyber Security Risk Office on strategic initiatives involving third-party cyber risk
• Ensure third-party cyber risk management activities support DTCC's overall risk management framework and contribute to maintaining a strong control environment, regulatory compliance, and operational resilience posture

NOTE: The Primary Responsibilities of this role are not limited to the details above.

Qualifications

• Minimum of 8 years of related experience in cyber security, cyber operations, cyber risk, IT audit, or technology risk.
• Bachelor's degree preferred or equivalent experience
• Professional certifications such as CISSP, CISA, CRISC or equivalent are a plus
• Knowledge of frameworks and regulations, including Cyber Risk Institute (CRI), National Institute of Standards and Technology (NIST) Cybersecurity Framework, Federal Financial Institutions Exa

The salary range is indicative for roles at the same level within DTCC across all US locations. Actual salary is determined based on the role, location, individual experience, skills, and other considerations. We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, sex, gender, gender expression, sexual orientation, age, marital status, veteran status, or disability status. We will ensure that individuals with disabilities are provided reasonable accommodation to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment. Please contact us to request accommodation.